CVE-2013-1664

XML libraries in Python 3.4 and earlier versions are vulnerable to XML Entity Expansion (XEE) attacks, causing denial of service

• CVSS 5.0
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• Input Validation and Sanitization
• Remote

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

CVE

CVE-2013-1664

CWE

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSS base score

5.0

Published

2013-04-03

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Python XML libraries to the latest version.

import xml.etree.ElementTree as ET

# Vulnerable XML input with a large number of entities
xml_input = """<?xml version="1.0"?>
<!DOCTYPE root [
    <!ENTITY a "A">
    <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">
    <!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
    <!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
    <!ENTITY e "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
    <!ENTITY f "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
    <!ENTITY g "&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;">
    <!ENTITY h "&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;">
    <!ENTITY i "&h;&h;&h;&h;&h;&h;&h;&h;&h;&h;">
    <!ENTITY j "&i;&i;&i;&i;&i;&i;&i;&i;&i;&i;">
]>
<root>&j;</root>
"""

# Parse the XML input
try:
    tree = ET.fromstring(xml_input)

import xml.etree.ElementTree as ET
import xml.sax.saxutils as saxutils

# Function to parse XML safely, preventing XML Entity Expansion (XEE) attacks
def safe_parse(xml_data):
    parser = ET.XMLParser(target=ET.TreeBuilder())
    parser.entity = {}  # Disable external entities
    return ET.fromstring(xml_data, parser=parser)

# Example usage
xml_input = """<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">]><!--
  <data>&xxe;</data>
-->"""

try:
    root = safe_parse(xml_input)
    print(ET.tostring(root, encoding='unicode'))
except ET.ParseError as e:
    print("XML parsing error:", e)

@misc{vaitp:cve20131664,
  title        = {{XML libraries in Python 3.4 and earlier versions are vulnerable to XML Entity Expansion (XEE) attacks, causing denial of service}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2013},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-1664},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-1664/}}
}