CVE-2024-41818: Fast-xml-parser DoS Vulnerability

CVE-2024-41818 Overview

CVE-2024-41818 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting fast-xml-parser, an open source pure JavaScript XML parser. The vulnerability exists in the currency.js value parser component, where a poorly crafted regular expression can be exploited to cause catastrophic backtracking, leading to application hangs and service disruption. This type of algorithmic complexity attack allows remote attackers to exhaust server resources by sending specially crafted input that triggers exponential processing time.

Critical Impact

Remote attackers can cause denial of service conditions by exploiting the ReDoS vulnerability in currency parsing functionality, potentially affecting any application that processes untrusted XML input using vulnerable versions of fast-xml-parser.

Affected Products

• fast-xml-parser versions prior to 4.4.1
• fast-xml-parser 4.2.4 for Node.js (confirmed affected)
• Applications using fast-xml-parser's currency value parser functionality

Discovery Timeline

• 2024-07-29 - CVE CVE-2024-41818 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-41818

Vulnerability Analysis

The vulnerability resides in the currency value parser component of fast-xml-parser, specifically in the regular expression used to parse currency values. Regular Expression Denial of Service (ReDoS) vulnerabilities occur when regex patterns contain nested quantifiers or overlapping alternations that can cause the regex engine to enter a state of catastrophic backtracking. When processing maliciously crafted input strings, the regex engine's backtracking behavior can cause exponential time complexity, effectively freezing the application.

The vulnerable code is located in /src/v5/valueParsers/currency.js at line 10, where the currency parsing regex is defined. This component is invoked when fast-xml-parser encounters XML content that needs currency value interpretation.

Root Cause

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). The regular expression pattern used for currency parsing contains constructs that are susceptible to catastrophic backtracking when presented with adversarial input. This design flaw allows attackers to craft input strings that maximize the number of backtracking operations the regex engine must perform.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by submitting XML content containing specially crafted strings designed to trigger the vulnerable regex pattern. When the parser attempts to process these strings through the currency value parser, the application becomes unresponsive due to excessive CPU consumption.

The attack is particularly dangerous in server-side applications that accept XML input from untrusted sources, as a single malicious request could tie up server resources and impact availability for legitimate users. The vulnerability affects confidentiality and integrity minimally but has a high impact on availability.

Detection Methods for CVE-2024-41818

Indicators of Compromise

• Abnormally high CPU utilization on servers processing XML input
• Application hangs or timeouts when parsing specific XML payloads
• Slow response times or service degradation in XML processing endpoints
• Thread pool exhaustion in Node.js applications using fast-xml-parser

Detection Strategies

• Monitor for unusual CPU spikes correlated with XML parsing operations
• Implement request timeout mechanisms to detect and terminate long-running parse operations
• Review application logs for repeated parsing failures or timeout errors
• Audit dependency manifests to identify fast-xml-parser versions prior to 4.4.1

Monitoring Recommendations

• Deploy application performance monitoring (APM) to track regex execution times
• Set up alerts for CPU utilization thresholds on servers handling XML processing
• Implement request-level timeouts for all XML parsing operations
• Monitor Node.js event loop lag to detect blocking operations caused by ReDoS

How to Mitigate CVE-2024-41818

Immediate Actions Required

• Upgrade fast-xml-parser to version 4.4.1 or later immediately
• Review all applications and services using fast-xml-parser as a dependency
• Implement input validation to limit the size and complexity of XML payloads
• Consider implementing request timeouts to limit the impact of exploitation attempts

Patch Information

The vulnerability has been fixed in fast-xml-parser version 4.4.1. The fix was committed to the main repository and can be verified through the official commit. Additional details are available in the GitHub Security Advisory GHSA-mpg4-rc92-vx8v.

To update using npm:

npm update fast-xml-parser

To verify your installed version:

npm list fast-xml-parser

Workarounds

• Implement request timeout limits on XML parsing operations to prevent prolonged CPU consumption
• Add input validation to reject excessively long or complex currency-formatted strings
• Consider using alternative XML parsers if immediate upgrade is not feasible
• Deploy rate limiting on endpoints that accept XML input to mitigate attack impact

# Example: Check and update fast-xml-parser in your project
npm outdated fast-xml-parser
npm install fast-xml-parser@^4.4.1
npm audit