Executive brief
libxmljs is an XML parsing library used by Node.js applications to read and process XML documents. A type confusion vulnerability occurs when parsing specially crafted XML files with entity declarations, allowing attackers to cause crashes, leak data, or execute arbitrary code when the attrs() function is called on certain nodes.
Technical details
The vulnerability is a type confusion flaw in the SWIG-generated wrapper function _wrap__xmlNode_properties_get() in libxml2.cc. When attrs() is invoked on a child node of an entity reference within a DOCTYPE, the function incorrectly casts an xmlEntity struct to an xmlNode struct. Because both structs share the same memory layout up to offset 44, but differ in what that offset contains (properties pointer in xmlNode vs. length integer in xmlEntity), reading from the wrong offset causes memory corruption. The attack requires a specially crafted XML file with DOCTYPE entity declarations and network/local delivery to the parsing application. Depending on system architecture and libxml2 compilation flags, this can result in denial of service, data exposure, or remote code execution on 32-bit systems with XML_PARSE_HUGE enabled.
Affected products
- libxmljs libxmljs 0 to 1.0.11
Timeline
- 2024-05-02: disclosed
- 2024-05-03: advisory: GitHub reviewed