PT-2023-24675 · Unknown · Fast-Xml-Parser

7085 · Publicado 2023-06-06 · Atualizado 2026-03-09 · CVE-2023-34104

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions prior to 4.2.4

Description The issue allows special characters in entity names, which are not escaped or sanitized. This can be abused for denial of service (DoS) attacks by crafting an entity name that results in an intentionally bad performing regex, causing the parser to stall for an indefinite amount of time.

Recommendations For versions prior to 4.2.4, upgrade to version 4.2.4 or later. For users unable to upgrade, avoid using DOCTYPE parsing by setting the processEntities: false option.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-1333

Identificadores relacionados

CVE-2023-34104

GHSA-6W63-H3FJ-Q4VW

Produtos afetados

Fast-Xml-Parser

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34104.json · Exploit
• https://github.com/NaturalIntelligence/fast-xml-parser · Nota
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/39b0e050bb909e8499478657f84a3076e39ce76c · Correção
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw · Aviso do Fabricante
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/a4bdced80369892ee413bf08e28b78795a2b0d5b · Nota
• https://t.me/cveNotify/154778 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-34104 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-34104 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6w63-h3fj-q4vw · Aviso do Fabricante