CVE-2019-16935

XSS vulnerability in Python XML-RPC server documentation

• CVSS 6.1
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Input Validation and Sanitization
• Remote

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.

CVE

CVE-2019-16935

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2019-09-28

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Cross-Site Scripting (XSS)

Fixed by upgrading

Yes

Solution

Upgrade to Python 3.7.5 or higher.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

@misc{vaitp:cve201916935,
  title        = {{XSS vulnerability in Python XML-RPC server documentation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-16935},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-16935/}}
}