5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-50602

CVE-2024-50602: An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser...

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-50602

CVE-2024-50602:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability occurs because XML_StopParser could be called on an XML parser that had been created (XML_ParserCreate) but not yet started (e.g., no input fed via XML_Parse or XML_ParseBuffer). This action would put the parser into an inconsistent state. Subsequently, if XML_ResumeParser was called on this parser, it would crash due to attempting to access uninitialized or improperly set internal structures, specifically leading to a NULL pointer dereference in normal_updatePosition as shown in the test case commit message (b3836ff534c7cc78128fe7b935aad3d4353814ed).

The primary vulnerable function is XML_ResumeParser because it's the one that crashes. However, XML_StopParser is also culpable because its incorrect behavior (allowing an unstarted parser to be stopped/suspended) sets up the conditions for the crash. The patches address the issue by modifying XML_StopParser to explicitly disallow stopping/suspending an unstarted parser (commit 51c7019069b862e88d94ed228659e70bddd5de09) and by adding test cases to verify this fix and the crash scenario (commit b3836ff534c7cc78128fe7b935aad3d4353814ed).

The runtime indicators would be XML_ResumeParser appearing in a stack trace, likely preceded by calls that set up the vulnerable state, such as XML_ParserCreate, XML_GetBuffer (or similar to get the parser into a state where XML_StopParser might be called), and then XML_StopParser itself. The crash itself, as detailed in the commit message for the test case, happens within normal_updatePosition, called by initUpdatePosition, which is called by XML_ResumeParser.

Therefore, the key functions involved in triggering the vulnerability are XML_StopParser (due to its flawed logic) and XML_ResumeParser (where the crash manifests).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.