CVE-2023-2798

Overview

HtmlUnit is a browser library for Java programs that operates without a graphical interface. It models HTML documents and lets applications load pages, fill forms, follow links, and execute JavaScript with configurable browser behavior. It is used for automated web testing and retrieving information from websites.

A denial of service vulnerability (CVE-2023-2798) has been identified in HtmlUnit's DOM node implementation, which allows attackers to crash HtmlUnit with a stack overflow by supplying a page with a very deeply nested element tree. Applications that use HtmlUnit to load untrusted web pages can be made unavailable this way.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects all versions of HtmlUnit before 2.70.0.

Details

Module Info

• Product: HtmlUnit
• Affected packages: net.sourceforge.htmlunit:htmlunit
• Affected versions: <2.70.0
• GitHub repository: https://github.com/HtmlUnit/htmlunit
• Published packages: https://central.sonatype.com/artifact/net.sourceforge.htmlunit/htmlunit
• Package manager: Maven
• Fixed in:
  • OSS HtmlUnit 2.70.0
  • NES for HtmlUnit v2.60.3

Vulnerability Info

This High-severity vulnerability is found in the net.sourceforge.htmlunit:htmlunit package in all versions of HtmlUnit before 2.70.0. Several methods of com.gargoylesoftware.htmlunit.html.DomNode walk up the DOM tree by recursion, adding one Java stack frame for every ancestor of the node they start from.

When a node is added, removed, or has its character data changed, HtmlUnit notifies listeners on that node and then calls the same method on the parent node:

protected void fireNodeAdded(final DomChangeEvent event) {
    final List<DomChangeListener> listeners = safeGetDomListeners();
    if (listeners != null) {
        for (final DomChangeListener listener : listeners) {
            listener.nodeAdded(event);
        }
    }
    if (parent_ != null) {
        parent_.fireNodeAdded(event);
    }
}

fireNodeDeleted and fireCharacterDataChanged follow the same pattern. The descendant element iterator used to walk a subtree also climbs back up the tree recursively when a branch has no further siblings:

private DomNode getNextElementUpwards(final DomNode startingNode) {
    if (startingNode == DomNode.this) {
        return null;
    }
    final DomNode parent = startingNode.getParentNode();
    if (parent == null || parent == DomNode.this) {
        return null;
    }
    DomNode next = parent.getNextSibling();
    while (next != null && !isAccepted(next)) {
        next = next.getNextSibling();
    }
    if (next == null) {
        return getNextElementUpwards(parent);
    }
    return next;
}

The recursion depth is bounded only by the nesting depth of the document, which the page author controls. A page that nests elements deeply enough makes HtmlUnit exhaust the thread's stack while it parses or modifies the page, and the resulting StackOverflowError aborts processing. An attacker who can get an HtmlUnit-based application to load such a page can crash it repeatedly and deny service to legitimate users.

Mitigation

HtmlUnit security fixes are made on the current development branch on a best-effort basis. Older releases should be migrated to a current release that contains the fix. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a current version of HtmlUnit that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.