Regex Injection via Doctype Entities

CVE-2023-34104

What is CVE-2023-34104?

The fast-xml-parser, an open-source pure JavaScript XML parser, contains a vulnerability that allows for improper handling of special characters in entity names. When these names are processed, they can create a poorly performing regular expression during entity replacement, leading to potential denial of service (DoS) conditions. Attackers can exploit this issue by crafting malicious entity names that stall the parser indefinitely. Users are strongly advised to upgrade to version 4.2.4 or later to mitigate this risk. For those unable to update, it is recommended to disable DOCTYPE parsing by setting the option 'processEntities: false'.

References