Expat UTF-16 Improper Surrogate Validation Vulnerability

Expat, a widely used C library for parsing XML, contains a vulnerability in its UTF-16 decoding logic affecting versions up to and including 2.8.4. The library fails to correctly validate low surrogates when they follow high surrogates in a UTF-16 stream. This flaw allows an attacker to craft malicious XML input containing lone high surrogates that inadvertently consume subsequent code units. By manipulating this consumption, an attacker can effectively hide specific markup characters from the XML parser. This obfuscation technique facilitates XML injection attacks, potentially allowing the bypass of downstream security controls that rely on the integrity of the parsed XML document, such as authorization decisions or data validation logic. Given Expat's ubiquitous integration into various applications and runtimes, this vulnerability presents a significant risk to systems that process untrusted XML input.

Impact

Successful exploitation of this vulnerability permits XML injection. In environments where security decisions are predicated on the content of parsed XML (e.g., SOAP requests, SAML assertions, or configuration files), an attacker may be able to manipulate the document structure, bypass input filters, or alter the logic interpreted by the application. This could lead to unauthorized access, elevation of privilege, or the circumvention of business logic, depending on how the application handles the output of the parser.

Recommendation

Prioritized actions for development and security teams:

• Identify all applications within the environment that bundle or dynamically link against the Expat library.
• Update any dependency on Expat to a version released after 2.8.4 once a patch is made available by the maintainers or upstream distributors.
• Until patching is complete, verify that incoming XML input is pre-validated for UTF-16 conformance using a strictly compliant parser before processing by the Expat-based application.
• Monitor for unusual XML structures or unexpected deviations in application behavior related to XML processing, specifically focusing on services that ingest high-volume or high-sensitivity XML data.