CVE-2019-1010017

Libnmap < v0.6.3: XML Injection DoS

• CVSS 7.5
• CWE-91 XML Injection (aka Blind XPath Injection)
• Input Validation and Sanitization
• Remote

libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.

CVE

CVE-2019-1010017

CWE

CWE-91 XML Injection (aka Blind XPath Injection)

CVSS base score

7.5

Published

2019-07-15

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update libnmap to version 0.6.3 or higher.

import xml.etree.ElementTree as ET

def parse_xml(xml_string):
    try:
        root = ET.fromstring(xml_string)
        return root
    except ET.ParseError as e:
        print("XML parsing error:", e)
        return None

xml_payload = "<root><data><![CDATA[<attack>]]></data><data>Some data</data></root>"
parsed_xml = parse_xml(xml_payload)
if parsed_xml is not None:
    print("XML parsed successfully:", ET.tostring(parsed_xml).decode())
else:
    print("Failed to parse XML.")

from lxml import etree

def parse_xml(xml_string):
    try:
        parser = etree.XMLParser(resolve_entities=False, no_network=True)
        root = etree.fromstring(xml_string, parser=parser)
        return root
    except etree.XMLSyntaxError as e:
        print("XML parsing error:", e)
        return None

xml_payload = "<root><data><![CDATA[<attack>]]></data><data>Some data</data></root>"
parsed_xml = parse_xml(xml_payload)
if parsed_xml is not None:
    print("XML parsed successfully:", etree.tostring(parsed_xml).decode())
else:
    print("Failed to parse XML.")

@misc{vaitp:cve20191010017,
  title        = {{Libnmap < v0.6.3: XML Injection DoS}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-1010017},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-1010017/}}
}