CVE-2024-1892: ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
Impact
The following parts of the Scrapy API were found to be vulnerable to a ReDoS attack:
- The XMLFeedSpider class or any subclass that uses the default node iterator: iternodes, as well as direct uses of the scrapy.utils.iterators.xmliter function.
- Scrapy 2.6.0 to 2.11.0: The openinbrowser function for a response without a base tag.
Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing.
Patches
Upgrade to Scrapy 2.11.1.
If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead.
Workarounds
For XMLFeedSpider, switch the node iterator to xml or html.
For openinbrowser, before using the function, either manually review the response content to discard a ReDos attack or manually define the base tag to avoid its automatic definition by openinbrowser later.
Acknowledgements
This security issue was reported by @nicecatch2000 through huntr.com.
Other sources
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1892?
The severity of CVE-2024-1892 is categorized as a moderate risk due to its vulnerability to ReDoS attacks.
How do I fix CVE-2024-1892?
To fix CVE-2024-1892, update Scrapy to version 1.8.4 or 2.11.1 or later.
What components of Scrapy are affected by CVE-2024-1892?
CVE-2024-1892 affects parts of the Scrapy API, specifically the XMLFeedSpider component.
Can CVE-2024-1892 lead to DoS attacks?
Yes, CVE-2024-1892 can be exploited to perform ReDoS attacks, leading to potential denial of service.
What is a ReDoS attack in relation to CVE-2024-1892?
A ReDoS attack exploits vulnerabilities in regular expressions to overwhelm the system and cause delays or crashes.