CVE-2024-49761
📋 TL;DR
CVE-2024-49761 is a Regular Expression Denial of Service (ReDoS) vulnerability in REXML, Ruby's XML toolkit. It allows attackers to cause denial of service by sending specially crafted XML documents with many digits in hex numeric character references. Only Ruby 3.1 is affected among maintained Ruby versions.
💻 Affected Systems
- Ruby REXML gem
- Ruby applications using REXML
📦 What is this software?
Rexml by Ruby Lang
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion from processing malicious XML, leading to sustained downtime.
Likely Case
Degraded application performance or temporary service disruption when processing malicious XML payloads.
If Mitigated
Minimal impact with proper input validation, rate limiting, and updated REXML versions.
🎯 Exploit Status
Exploit requires sending malicious XML to vulnerable endpoints. Public advisory includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: REXML gem 3.3.9 or later
Vendor Advisory: https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
Restart Required: Yes
Instructions:
1. Update REXML gem: 'gem update rexml' 2. Update Gemfile.lock if using Bundler 3. Restart Ruby application services 4. Verify version with 'gem list rexml'
🔧 Temporary Workarounds
Input validation and sanitization
allValidate and sanitize XML input before processing with REXML
Upgrade Ruby version
linuxUpgrade from Ruby 3.1 to Ruby 3.2 or later
rvm install ruby-3.2.0
rbenv install 3.2.0
🧯 If You Can't Patch
- Implement strict input validation and XML schema validation
- Deploy WAF rules to block XML with excessive hex character references
🔍 How to Verify
Check if Vulnerable:
Check Ruby version with 'ruby -v' and REXML version with 'gem list rexml'. Vulnerable if Ruby 3.1.x with REXML < 3.3.9.Check Version:
ruby -v && gem list rexml | grep rexmlVerify Fix Applied:
Verify REXML version is 3.3.9+ with 'gem list rexml | grep rexml' and test with sample malicious XML.📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes in Ruby processes
- XML parsing errors or timeouts
- Unusually large XML payloads in request logs
Network Indicators:
- Multiple XML requests with hex character references
- XML payloads with patterns like '&#x' followed by many digits
SIEM Query:
source="application.log" AND ("REXML" OR "XML parse") AND ("timeout" OR "CPU" OR "&#x")🔗 References
- https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
- https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
- https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
- https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
- https://security.netapp.com/advisory/ntap-20241227-0004/
