Executive brief
libxmljs is an XML parsing library widely used in Node.js applications. A type confusion vulnerability in its namespaces() function allows an attacker to craft malicious XML files that, when parsed by a vulnerable application, can crash the service or execute arbitrary code on the server running the application.
Technical details
The vulnerability is a type confusion (CWE-843) in the SWIG-generated wrapper function _wrap__xmlNode_nsDef_get() within libxmljs. When the namespaces() function is invoked on a grandchild node that refers to an XML entity in specially crafted XML, a pointer type mismatch occurs that allows the function to operate on an incorrect object type. The attack requires network access to send the malicious XML to an application using libxmljs, but does not require authentication or user interaction. An attacker can achieve denial of service through crashes or remote code execution by exploiting the confused pointer reference. Versions through 1.0.11 are affected; patch availability should be confirmed in the upstream repository.
Affected products
- libxmljs libxmljs through 1.0.11
Timeline
- 2024-05-02: disclosed: Published to GHSA and NVD
- 2023-11-27: other: Issue reported to GitHub