CVE-2013-1665

XML libraries in Python 3.4 and earlier versions are vulnerable to XXE attacks

• CVSS 5.0
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• Input Validation and Sanitization
• Remote

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.

CVE

CVE-2013-1665

CWE

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSS base score

5.0

Published

2013-04-03

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update Python to a version that addresses the XXE vulnerability.

import xml.etree.ElementTree as ET

def parse_xml(xml_data):
    # VULNERABLE: This code is susceptible to command injection
    try:
        tree = ET.fromstring(xml_data)
        return tree
    except ET.ParseError as e:
        print(f"Parse error: {e}")

xml_input = """<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY file SYSTEM "file:///etc/passwd">
]>
<root>
  <data>&file;</data>
</root>
"""

result = parse_xml(xml_input)

import defusedxml.ElementTree as ET

def parse_xml(xml_data):
    # SECURE: This version prevents command injection
    try:
        tree = ET.fromstring(xml_data)
        return tree
    except ET.ParseError as e:
        print(f"Parse error: {e}")

xml_input = """<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY file SYSTEM "file:///etc/passwd">
]>
<root>
  <data>&file;</data>
</root>
"""

result = parse_xml(xml_input)

@misc{vaitp:cve20131665,
  title        = {{XML libraries in Python 3.4 and earlier versions are vulnerable to XXE attacks}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2013},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-1665},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-1665/}}
}