processone/xml — pull request #1 by efine (2013-09-12 19:33:06+00:00)
Title: Patch for CVS-2013-1664 vulnerability

I reported this in ticket EJAB-1662. I have reproduced the contents of that ticket here for your convenience.

I believe ejabberd is vulnerable to the XML Entity Expansion attack described in [CVE-2013-1664|http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1664]. I have verified this by running a small test program on a few different ejabberd servers, including one I just built from ejabberd 13.06 source pulled from github (well, the issue is really in the xml repo, which ejabberd pulls as a dep).

The attack is a DoS attack and is not fixed by the "billion laughs" patch created to solve that problem. The symptom is that after sending the stream XML, ejabberd takes 40 - 50 seconds to respond, while pegging a CPU at 100%.

The reason why the other fix (setting the XML default handler to NULL) doesn't work for this attack is because it apparently has no effect on entities expanded in an XML attribute. The original billion laughs test only seemed to put an entity reference in an XML element.

Anyway, it is very easy to reproduce this problem. Run the attached script (very ugly - I am not a python programmer) on an ejabberd server on localhost and watch the response. It's currently written to use old-style TLS on port 5223 because that's how my servers are configured, but feel free to change it.

You can also reproduce this by using openssl s_client -connect host:port (or netcat, or whatever) and manually pasting in the attack XML.

I do have a patch for this which I have tested to some extent. I am about to issue a pull request on github for the processone/xml repository. This patch simply disables DTD processing by registering a DOCTYPE decl handler, and calling XML_StopParser within it. Seems to work pretty well.

Please feel free to use this pull request if you find it useful.