CVE-2024-25885

What it actually does

The flaw permits an attacker to supply a crafted string to the getcolor function that triggers catastrophic backtracking in its regular expression, resulting in excessive CPU consumption and denial of service.

Why it matters to the business

Applications using the library can be forced into unresponsiveness or high resource usage, causing service outages, degraded performance for legitimate users, and increased infrastructure costs until the attack stops.

How an attack unfolds

An attacker locates any code path that passes untrusted input to the vulnerable getcolor function, crafts a string that forces the regex engine into repeated backtracking, and submits it repeatedly to exhaust CPU resources and deny service to other users.

How to fix it

Upgrade xhtml2pdf to the latest patched release; where immediate upgrade is not possible, add input length limits, replace the vulnerable regex, or enforce execution timeouts around color parsing.

How to confirm the fix worked

Confirm the installed xhtml2pdf version is current, then execute the getcolor function against known ReDOS test strings and verify that processing completes within expected time bounds without spikes in CPU usage.

Typical attack path

1. Locate an input vector that reaches the getcolor function in utils.py
2. Construct a malicious string engineered for regex ReDOS
3. Deliver the string via HTTP request, API call, or file processing
4. Sustain traffic to maintain CPU exhaustion and service degradation

How to detect it

Inspect application and system logs for sustained high CPU usage correlated with color parsing or PDF generation requests; review web server access logs for repeated submissions of unusually long or patterned strings to affected endpoints.

What your security team should do

• Apply the library upgrade as the primary remediation
• Add input validation and regex timeouts as defense-in-depth
• Monitor application CPU and request latency for anomalies
• Review and restrict untrusted color or style inputs where feasible