CVE-2023-26920

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.

Impact

As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.

const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser();
let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches

The problem has been patched in v4.1.2

Workarounds

User can check for "proto" in the XML string before parsing it to the parser.

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution.

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.19.0-tuxcare.1.

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.17.5-tuxcare.1.

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.14.0-tuxcare.1.

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution.

Root has patched CVE-2023-26920 in the @rootio/fast-xml-parser package for Root:npm. Multiple fixed versions available.