CVE-2024-34391: 
JavaScript vulnerability analysis and mitigation

CVE-2024-34391 is a type confusion vulnerability discovered in libxmljs, reported on May 2, 2024. The vulnerability affects the library when parsing specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node (JFrog Research, NVD).

The vulnerability occurs in the _wrap__xmlNode_properties_get function when parsing an XML with a DOCTYPE containing an entity. When calling attrs() on a grand-child of an XML node that refers to that entity, a type confusion occurs because the function incorrectly casts an xmlEntity pointer to an xmlNode pointer. This confusion leads to misinterpreting the entity's length field as a pointer to xmlAttr properties (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to multiple severe impacts depending on the system configuration. On 32-bit systems with XML_PARSE_HUGE flag enabled, it can result in remote code execution, denial of service, infinite loop, and data leak. On 64-bit systems and 32-bit systems without XML_PARSE_HUGE flag, it primarily leads to denial of service (JFrog Research).

The vulnerability can be exploited by parsing a specially crafted XML document that contains a DOCTYPE with an entity, and then calling the attrs() function on a grand-child of a node that references that entity. A proof of concept exploit has been publicly disclosed (GitHub Issue).

No official mitigations have been provided for this vulnerability as of the reporting date (JFrog Research).