Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23476

CVE-2022-23476: Unchecked return value from xmlTextReaderExpand

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23476
GHSA ID
GHSA-qv4q-mr5r-qprj
EPSS Score
0.40849%
CWE
CWE-252
Published
12/8/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
nokogirirubygems>= 1.13.8, < 1.13.101.13.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability explicitly references Nokogiri::XML::Reader#attribute_hash as the affected method. The commit diff shows a NULL check was added after calling xmlTextReaderExpand in ext/nokogiri/xml_reader.c, confirming this was the missing safety check. The C function rb_xml_reader_attribute_hash implements this Ruby method, and the lack of NULL check on c_node directly matches the described vulnerability mechanism (CWE-476 via CWE-252).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## Summ*ry Noko*iri `*.**.*, *.**.*` **ils to ****k t** r*turn v*lu* *rom `xmlT*xtR****r*xp*n*` in t** m*t*o* `Noko*iri::XML::R****r#*ttri*ut*_**s*`. T*is **n l*** to * null point*r *x**ption w**n inv*li* m*rkup is **in* p*rs**. *or *ppli**tions u

Reasoning

T** vuln*r**ility *xpli*itly r***r*n**s Noko*iri::XML::R****r#*ttri*ut*_**s* *s t** *****t** m*t*o*. T** *ommit *i** s*ows * NULL ****k w*s ***** **t*r **llin* xmlT*xtR****r*xp*n* in *xt/noko*iri/xml_r****r.*, *on*irmin* t*is w*s t** missin* s***ty *