REDHAT-BUG-2441501: XSS
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fast-xml-parserto a version that resolves this vulnerability.Fixed in 5.3.5
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2441501?
The severity of REDHAT-BUG-2441501 is categorized as high, with a risk rating of 7.
How do I fix REDHAT-BUG-2441501?
To address REDHAT-BUG-2441501, upgrade fast-xml-parser to version 5.3.5 or later.
What type of vulnerability is REDHAT-BUG-2441501?
REDHAT-BUG-2441501 is related to Cross-Site Scripting (XSS) issues due to improper handling of DOCTYPE entity names.
Which versions of fast-xml-parser are affected by REDHAT-BUG-2441501?
Versions of fast-xml-parser from 4.1.3 to before 5.3.5 are affected by REDHAT-BUG-2441501.
What are the potential impacts of REDHAT-BUG-2441501?
The potential impacts of REDHAT-BUG-2441501 include the ability for attackers to shadow build entities using DOCTYPE, leading to security breaches.