GHSA-xxx9-3xcr-gjj3 XML Injection in Xerces Java affects Nokogiri
An XML injection flaw in the vendored Xerces parser allows attackers to cause a denial of service via infinite loops in JRuby Nokogiri.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xxx9-3xcr-gjj3?
GHSA-xxx9-3xcr-gjj3 is a denial of service vulnerability in nokogiri, published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to 2.12.2, which addresses CVE-2022-23437. That CVE is scored as CVSS 6.5 "Medium" on the NVD record.
Please note that this advisory only applies to the JRuby implementation of Nokogiri < 1.13.4.
Mitigation
Upgrade to Nokogiri >= v1.13.4.
Impact
CVE-2022-23437 in xerces-J
- Severity: Medium
- Type: CWE-91 XML Injection (aka Blind XPath Injection)
- Description: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- See also: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
Which versions are affected by GHSA-xxx9-3xcr-gjj3?
2 open source packages ship an affected version, including nokogiri.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.13.4 |
nokogiri RubyGems | All versions | 1.13.4 |
How do I fix GHSA-xxx9-3xcr-gjj3?
Upgrade nokogiri to 1.13.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-xxx9-3xcr-gjj3 being exploited?
There is no known exploitation of GHSA-xxx9-3xcr-gjj3 in the wild and no public exploit code.