CVE-2024-28757

What it actually does

Allows XML Entity Expansion attacks when external parsers are created via XML_ExternalEntityParserCreate in isolated contexts, leading to uncontrolled recursive entity expansion and resource exhaustion.

Why it matters to the business

Applications using libexpat for XML processing may experience denial of service through excessive memory or CPU consumption, disrupting services and increasing operational costs until patched.

How an attack unfolds

An attacker supplies a crafted XML document that triggers external entity parsing through XML_ExternalEntityParserCreate, causing the parser to recursively expand entities without limits and exhaust system resources.

How to fix it

Upgrade libexpat to the fixed commit fa75b96546c069d17b8f80d91e0f4ef0cde3790d or later; rebuild and redeploy all dependent applications; disable external entity parsing where possible until updated.

How to confirm the fix worked

Verify the installed libexpat version or commit hash against fa75b96546c069d17b8f80d91e0f4ef0cde3790d; test parsing of known expansion payloads in isolated external parser contexts to confirm resource limits are enforced.

Typical attack path

1. Identify an application endpoint or feature that accepts and processes XML using libexpat with external parser creation.
2. Craft malicious XML containing recursive external entity references.
3. Submit the XML payload to trigger isolated external parsing.
4. Observe resource exhaustion leading to service degradation or crash.

How to detect it

Review application logs and system metrics for sudden high memory or CPU usage correlated with XML parsing activity; inspect process trees for libexpat-based parsers handling untrusted input.

What your security team should do

• Prioritize patching all libexpat instances to the fixed commit within standard maintenance windows due to the high availability impact.
• Audit codebases for use of XML_ExternalEntityParserCreate and restrict external entity resolution.
• Monitor for unusual spikes in memory or CPU during XML processing as a temporary detection measure.
• Update dependency scanning tools to flag vulnerable libexpat versions below the fixed commit.