run-llama llama_index XML Entity Expansion Vulnerability Leading to Denial-of-Service

A vulnerability allowing XML Entity Expansion, commonly known as a 'billion laughs' attack, has been identified in the sitemap parser of the run-llama/llama_index repository, specifically in version v0.12.21. This vulnerability enables an attacker to submit a malicious Sitemap XML, causing a Denial-of-Service (DoS) by depleting system memory and potentially leading to a system crash.

Impact

Exploitation of this vulnerability can cause excessive memory consumption, potentially leading to a system crash.

Reproduction

The vulnerability can be reproduced by uploading a malicious Sitemap XML file designed to exploit XML Entity Expansion. This can be done through the application's sitemap parser, which is located in the 'llama-index-integrations/readers/web/sitemap' directory.

Remediation

Users can upgrade to version v0.12.29 or later to address this vulnerability.