Apache Xerces-J DoS via StackOverflowError in XSDHandler.resolvePSVI

Vulnerability Overview The vulnerability exists in the class, specifically within the method. When processing XML documents, if the XML document contains specific structures, it leads to a , resulting in a Denial of Service (DoS) attack. Affected Scope Affected Versions: Apache Xerces-J 2.11.0 and earlier. Vulnerability Type: Denial of Service (DoS). Trigger Condition: The XML document contains specific structures that cause excessive recursive calls, ultimately leading to a stack overflow. Remediation Version Upgrade: Upgrade to Apache Xerces-J 2.12.0 or later, which includes a fix for this vulnerability. Code Modification: If upgrading is not feasible, consider modifying the method in the class to add recursion depth limits, thereby preventing stack overflow. POC Code ```java import com.sun.org.apache.xerces.internal.impl.xs.traversers.XSDHandler; import com.sun.org.apache.xerces.internal.xs.XSModel; import com.sun.org.apache.xerces.internal.xs.XSTypeDefinition; import com.sun.org.apache.xerces.internal.xs.XSAttributeDeclaration; import com.sun.org.apache.xerces.internal.xs.XSAttributeUse; import com.sun.org.apache.xerces.internal.xs.XSObjectList; import com.sun.org.apache.xerces.internal.xs.XSNamedMap; import com.sun.org.apache.xerces.internal.xs.XSImplementation; import com.sun.org.apache.xerces.internal.xs.XSModelGroup; import com.sun.org.apache.xerces.internal.xs.XSModelGroupDefinition; import com.sun.org.apache.xerces.internal.xs.XSNotationDeclaration; import com.sun.org.apache.xerces.internal.xs.XSNotationList; import com.sun.org.apache.xerces.internal.xs.XSObject; import com.sun.org.apache.xerces.internal.xs.XSParameter; import com.sun.org.apache.xerces.internal.xs.XSParameterList; import com.sun.org.apache.xerces.internal.xs.XSParameterSpec; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecList; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIterator; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNode; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIterator; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNode; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNodeIterator; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNodeIteratorNode; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNodeIteratorNodeIterator; import com.sun.org.apache.xerces.internal.xs.XSParameterSpecListImpl.XSParameterSpecListIteratorImpl.XSParameterSpecListIteratorImplNode.XSParameterSpecListIteratorImplNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIterator.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNode.XSParameterSpecListIteratorImplNodeIteratorNodeIteratorNodeIteratorNodeIteratorNode; import com.s

Goal Reached Thanks to every supporter — we hit 100%!

Apache Xerces-J DoS via StackOverflowError in XSDHandler.resolvePSVI

More from this source