Memory Leak in Nokogiri XSLT Transform

Executive Summary

Nokogiri versions before 1.19.3 have a memory leak in the XSLT Stylesheet transform method when processing Ruby strings with null bytes. Attackers can exploit this by sending input containing null bytes to transform parameters, causing small heap allocations to leak. This can lead to denial of service in long-running processes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed Nokogiri version using the command 'gem list nokogiri'. If the version is below 1.19.3, the system is vulnerable. Additionally, review application code for XSLT transform calls passing untrusted input with null bytes.

Useful 0 Not Useful 0

Impact Analysis

If you use Nokogiri versions before 1.19.3 and pass attacker-controlled input with null bytes to XSLT transform parameters, this could cause memory leaks in long-running processes. This may result in gradual memory exhaustion, leading to performance degradation or crashes, effectively causing a denial of service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it does not involve data disclosure or corruption. It primarily causes memory leaks leading to denial of service in long-running processes, which is unlikely to violate these standards unless service disruption impacts data availability.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nokogiri to version 1.19.3 or later using 'gem update nokogiri'. If upgrading is not immediately possible, validate all untrusted input passed to XSLT transform parameters to ensure no null bytes are present before processing.

Useful 0 Not Useful 0