CVE-2023-34623: Jtidy_project Jtidy DOS Vulnerability

CVE-2023-34623 Overview

CVE-2023-34623 is a denial of service vulnerability discovered in JTidy through revision r938. The vulnerability allows attackers to cause a denial of service or potentially other unspecified impacts by supplying a crafted object that exploits cyclic dependencies within the library's processing logic. JTidy is a popular Java port of HTML Tidy, widely used for cleaning up and validating HTML markup in Java applications.

Critical Impact
Attackers can remotely crash or hang applications using vulnerable JTidy versions by submitting maliciously crafted input containing cyclic dependencies, leading to resource exhaustion and service disruption.

Affected Products

JTidy through revision r938
Applications and services integrating vulnerable JTidy versions
Java-based web applications using JTidy for HTML parsing and cleanup

Discovery Timeline

2023-06-14 - CVE CVE-2023-34623 published to NVD
2025-01-03 - Last updated in NVD database

Technical Details for CVE-2023-34623

Vulnerability Analysis

This vulnerability stems from improper handling of cyclic dependencies when JTidy processes specially crafted input objects. When the library encounters data structures containing circular references, it fails to properly detect and break these cycles, leading to unbounded recursion or infinite loops. This behavior can consume excessive CPU and memory resources, ultimately causing the application to become unresponsive or crash.

The vulnerability is classified under CWE-787 (Out-of-bounds Write), though the primary observable impact is denial of service through resource exhaustion. The network-accessible nature of this vulnerability means that any application exposing JTidy functionality to untrusted input—such as web applications that clean user-submitted HTML—could be vulnerable to remote exploitation without requiring authentication.

Root Cause

The root cause of CVE-2023-34623 lies in JTidy's failure to implement proper cycle detection when traversing object graphs or processing nested structures. When presented with input containing cyclic dependencies, the parser enters an unbounded processing state, attempting to recursively resolve references that ultimately point back to previously visited nodes. This lack of depth limiting or visited-node tracking results in stack overflow conditions or infinite iteration loops.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a maliciously crafted HTML document or object structure to an application that processes the input using JTidy. The crafted input contains cyclic dependencies that trigger the vulnerable code path.

Exploitation scenarios include:

Web applications that use JTidy to sanitize or format user-submitted HTML content
Backend services that process HTML documents from external sources
Content management systems using JTidy for HTML cleanup operations

For technical details on the vulnerability mechanism, refer to the GitHub Issue Discussion where the issue is documented.

Detection Methods for CVE-2023-34623

Indicators of Compromise

Unusual CPU or memory spikes in applications using JTidy for HTML processing
Application threads stuck in long-running or infinite loops during HTML parsing operations
Out-of-memory errors or stack overflow exceptions in JTidy-related code paths
Repeated timeout errors when processing specific HTML input documents

Detection Strategies

Monitor application performance metrics for anomalous resource consumption during HTML processing operations
Implement logging around JTidy parsing calls to identify inputs that cause extended processing times
Use application performance monitoring (APM) tools to track thread states and identify hung threads in JTidy code
Scan application dependencies using software composition analysis (SCA) tools to identify vulnerable JTidy versions

Monitoring Recommendations

Configure alerting on memory and CPU thresholds for services that utilize JTidy
Implement request timeout mechanisms for endpoints that process untrusted HTML input
Enable verbose logging for JTidy operations in staging environments to identify problematic input patterns
Regularly review dependency manifests (Maven pom.xml, Gradle build files) to track JTidy version usage

How to Mitigate CVE-2023-34623

Immediate Actions Required

Identify all applications and services in your environment that depend on JTidy
Review JTidy version dependencies in Maven, Gradle, or other build configurations
Implement input size limits and processing timeouts for HTML parsing operations
Consider alternative HTML cleaning libraries if JTidy updates are not available

Patch Information

As of the last update to this CVE, specific patch information from the JTidy project was not available in the advisory data. Organizations should monitor the JTidy GitHub repository for updates regarding fixes or patched versions. Check for newer releases that may address this vulnerability.

Workarounds

Implement strict input validation and size limits on HTML content before passing to JTidy
Add processing timeouts around JTidy parsing operations to prevent resource exhaustion
Run JTidy processing in isolated threads with resource limits to contain potential DoS conditions
Consider using alternative HTML sanitization libraries such as jsoup with proper configuration

bash

# Example Maven dependency check command
mvn dependency:tree | grep -i jtidy
# Review output for jtidy versions and update to patched version when available