CVE-2019-20201

Step 1: Payload Delivery: The attacker crafts a malicious XML file containing a recursive entity definition. This definition can be direct (e.g., <!ENTITY x "&x;">) or indirect (e.g., <!ENTITY a "&b;"> <!ENTITY b "&a;">).

Step 2: File Ingestion: The vulnerable application, using ezXML, attempts to parse the malicious XML file.

Step 3: Entity Resolution: The ezxml_parse_* functions begin to resolve the entities. Due to the recursive nature, the parser enters a loop.

Step 4: Memory Exhaustion: Within the loop, the parser repeatedly allocates memory to resolve the entity, but the resolution never completes. This leads to a rapid depletion of available memory.

Step 5: Denial of Service: The application either crashes due to memory exhaustion or becomes unresponsive, effectively resulting in a denial-of-service condition.

The vulnerability stems from the ezxml_parse_* functions within the ezXML library. These functions fail to properly handle recursive XML entity definitions. Specifically, the parsing logic doesn't adequately check for circular references within the entity definitions. When a malicious XML file with a recursively defined entity (e.g., an entity that references itself directly or indirectly) is parsed, the parser enters an infinite loop. This loop leads to repeated memory allocation attempts, eventually exhausting available system resources (memory) and causing the application to crash. The root cause is a lack of proper validation and cycle detection within the entity resolution process, leading to uncontrolled resource consumption.