fast-xml-parser vulnerable to ReDOS at currency parsing
High severity
GitHub Reviewed
Published
Jul 28, 2024
in
NaturalIntelligence/fast-xml-parser
•
Updated Aug 8, 2024
Description
Published by the National Vulnerability Database
Jul 29, 2024
Published to the GitHub Advisory Database
Jul 29, 2024
Reviewed
Jul 29, 2024
Last updated
Aug 8, 2024
Summary
A ReDOS exists on currency.js was discovered by Gauss Security Labs R&D team.
Details
https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10
contains a vulnerable regex
PoC
pass the following string '\t'.repeat(13337) + '.'
Impact
Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library
https://gauss-security.com
References