CVE-2024-28757: Libexpat XXE Vulnerability

CVE-2024-28757 Overview

CVE-2024-28757 is a denial of service vulnerability in libexpat, a widely-used XML parsing library, through version 2.6.1. The vulnerability allows attackers to perform an XML Entity Expansion attack (also known as "Billion Laughs" attack) when applications make isolated use of external parsers created via the XML_ExternalEntityParserCreate function. This can lead to excessive memory consumption and CPU exhaustion, effectively causing a denial of service condition.

Critical Impact
Remote attackers can exploit this vulnerability to cause denial of service through resource exhaustion without requiring authentication or user interaction.

Affected Products

libexpat_project libexpat (through version 2.6.1)
Fedora 38, 39, and 40
NetApp Active IQ Unified Manager
NetApp OnCommand Workflow Automation
NetApp ONTAP and ONTAP Tools
NetApp Windows Host Utilities
NetApp H-Series Hardware (H300s, H500s, H700s, H410s, H410c, H610c, H610s) and firmware

Discovery Timeline

2024-03-10 - CVE-2024-28757 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-28757

Vulnerability Analysis

This vulnerability is classified as CWE-776 (Improper Restriction of Recursive Entity References in DTDs), commonly associated with XML Entity Expansion attacks. The flaw exists in how libexpat handles external entity parsing when applications use the XML_ExternalEntityParserCreate function in isolation.

When processing maliciously crafted XML documents, the parser fails to properly restrict recursive entity references. An attacker can construct XML documents with nested entity definitions that expand exponentially when parsed, leading to resource exhaustion. This attack pattern requires no authentication and can be triggered remotely over the network whenever an application parses untrusted XML input using vulnerable versions of libexpat.

The impact is limited to availability rather than confidentiality or integrity, as the vulnerability results in denial of service through memory and CPU exhaustion rather than information disclosure or code execution.

Root Cause

The root cause lies in improper restriction of recursive entity references when external parsers are created via XML_ExternalEntityParserCreate. The library does not adequately limit the expansion of nested XML entities in this specific parsing context, allowing exponential growth of parsed content from relatively small XML input. This is a classic Billion Laughs attack vector where each entity reference expands to multiple copies of another entity, creating an exponential explosion in memory usage.

Attack Vector

The attack vector is network-based, requiring an attacker to submit a specially crafted XML document to an application that uses libexpat for parsing. The attack characteristics include:

Network Accessible: Attackers can exploit this remotely without local access
Low Complexity: No special conditions or prerequisites required
No Privileges Required: Authentication is not needed to trigger the vulnerability
No User Interaction: Exploitation does not require victim interaction

An attacker would craft an XML document containing deeply nested entity definitions that reference each other recursively. When the target application parses this document using an external parser created via XML_ExternalEntityParserCreate, the entity expansion consumes excessive system resources.

The vulnerability mechanism involves crafting XML with recursive entity references. When the parser encounters these nested entities created via XML_ExternalEntityParserCreate, each entity expands to multiple copies of another entity, causing exponential memory growth. Technical details are available in the GitHub Issue #839.

Detection Methods for CVE-2024-28757

Indicators of Compromise

Abnormally high memory consumption by processes using libexpat for XML parsing
CPU spikes correlated with XML processing operations
Application crashes or unresponsive services following XML document submission
Large XML documents with excessive entity declarations in application logs

Detection Strategies

Monitor system resource utilization for processes handling XML parsing operations
Implement application-level logging to track XML parsing duration and resource consumption
Deploy network-based detection rules to identify XML documents with excessive entity declarations
Use software composition analysis (SCA) tools to identify applications using vulnerable libexpat versions

Monitoring Recommendations

Configure alerts for memory exhaustion events in systems running XML processing applications
Establish baseline resource utilization metrics for XML parsing services to detect anomalies
Monitor application logs for XML parsing errors or timeout events
Track libexpat version deployments across infrastructure using asset inventory tools

How to Mitigate CVE-2024-28757

Immediate Actions Required

Upgrade libexpat to version 2.6.2 or later, which contains the fix for this vulnerability
Audit applications and systems to identify all instances of libexpat usage
Apply vendor-specific patches for affected NetApp and Fedora products
Consider implementing input validation to limit XML document size and entity depth

Patch Information

The fix for CVE-2024-28757 is available in the libexpat repository. The patch addresses the recursive entity expansion issue in external parser handling. Organizations should apply updates from their respective vendors:

libexpat: Update to version 2.6.2 or later via GitHub Pull Request #842
Fedora: Apply updates via the Fedora package announcements
NetApp: Refer to NetApp Security Advisory ntap-20240322-0001

Workarounds

Implement XML entity expansion limits at the application level where possible
Configure web application firewalls to detect and block XML documents with excessive entity declarations
Disable external entity processing if not required by the application
Consider using alternative XML parsing configurations that do not rely on XML_ExternalEntityParserCreate

bash

# Verify libexpat version on Linux systems
expat-config --version
# or
pkg-config --modversion expat

# Check for affected packages on Fedora
rpm -qa | grep expat

# Update libexpat on Fedora
sudo dnf update expat