CVE-2024-55549
📋 TL;DR
CVE-2024-55549 is a use-after-free vulnerability in libxslt's xsltGetInheritedNsList function that occurs when excluding result prefixes. This allows attackers to potentially execute arbitrary code or cause denial of service by processing malicious XSLT stylesheets. Any application using vulnerable libxslt versions for XML/XSLT processing is affected.
💻 Affected Systems
- libxslt
- Applications using libxslt (e.g., web browsers, XML processors, document converters)
📦 What is this software?
Libxslt by Xmlsoft
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service, potentially leading to data corruption in XML processing pipelines.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially just application instability.
🎯 Exploit Status
Exploitation requires the attacker to supply malicious XSLT content to a vulnerable application. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libxslt 1.1.43 and later
Vendor Advisory: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127
Restart Required: No
Instructions:
1. Update libxslt to version 1.1.43 or later using your system package manager. 2. For Debian/Ubuntu: apt update && apt upgrade libxslt1.1. 3. For RHEL/CentOS: yum update libxslt. 4. Recompile any statically linked applications with the patched library.
🔧 Temporary Workarounds
Disable XSLT processing for untrusted content
allConfigure applications to avoid using libxslt for processing untrusted XML/XSLT content
Input validation and sanitization
allImplement strict input validation to reject or sanitize potentially malicious XSLT content
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from untrusted networks
- Deploy web application firewalls (WAF) with XML/XSLT attack detection rules
🔍 How to Verify
Check if Vulnerable:
Check libxslt version with: xsltproc --version | grep 'libxslt'Check Version:
xsltproc --version | grep 'libxslt'Verify Fix Applied:
Verify version is 1.1.43 or higher: xsltproc --version | grep 'libxslt'📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults in libxslt functions
- Unusual XML/XSLT processing errors
- Memory corruption warnings in system logs
Network Indicators:
- Unusually large or complex XML/XSLT payloads to XML processing endpoints
- Multiple failed transformation attempts
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "libxslt" OR "xsltGetInheritedNsList")