Stack Overflow in TOML::XS Perl Module

Executive Summary

This vulnerability is an uncontrolled recursion flaw in the tomlc99 TOML parser library used by TOML::XS versions before 0.06 for Perl. It allows stack overflow attacks via deeply nested TOML structures, such as dotted keys or arrays, causing crashes when parsing untrusted input.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using TOML::XS versions before 0.06 or the tomlc99 library for deeply nested TOML files. Check for crashes or segmentation faults when parsing untrusted TOML input. Use tools like AddressSanitizer or GDB to identify stack overflows during parsing.

Useful 0 Not Useful 0

Impact Analysis

If you use TOML::XS with versions before 0.06, attackers could craft malicious TOML files with excessive nesting to trigger stack overflows. This could crash your application, leading to denial of service or potential code execution if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service through stack overflow when parsing deeply nested TOML structures. It does not directly impact compliance with GDPR or HIPAA as it is a technical implementation flaw rather than a data protection issue. However, if an application using this library crashes while processing user data, it could indirectly affect availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to TOML::XS version 0.06 or later, which uses the tomlc17 library. Replace any usage of the obsolete tomlc99 library with tomlc17. Avoid parsing untrusted TOML input with vulnerable versions to prevent stack overflows.

Useful 0 Not Useful 0