Quick answers
- Is CVE-2024-34391 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-34391 being exploited in the wild.
- How severe is CVE-2024-34391?
- Low severity, with a CVSS score of 3.1, published 2 May 2024.
- Which products and versions are affected?
- libxmljs (npm) SEMVER:introduced=0,last_affected=1.0.11.
- Is there a fix for CVE-2024-34391?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2024-34391 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-34391?
- Check whether you run libxmljs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a type confusion flaw in the SWIG-generated wrapper function _wrap__xmlNode_properties_get() in libxml2.cc. When attrs() is invoked on a child node of an entity reference within a DOCTYPE, the function incorrectly casts an xmlEntity struct to an xmlNode struct. Because both structs share the same memory layout up to offset 44, but differ in what that offset contains (properties pointer in xmlNode vs. length integer in xmlEntity), reading from the wrong offset causes memory corruption. The attack requires a specially crafted XML file with DOCTYPE entity declarations and network/local delivery to the parsing application. Depending on system architecture and libxml2 compilation flags, this can result in denial of service, data exposure, or remote code execution on 32-bit systems with XML_PARSE_HUGE enabled.
Affected products
- libxmljs libxmljs 0 to 1.0.11
Identifiers
- CVE-2024-34391
- GHSA-6433-x5p4-8jc7
Timeline
- 2024-05-02: disclosed
- 2024-05-03: advisory: GitHub reviewed