CVE-2020-5227

XML DoS in pre-0.9.0 Feedgen (Python), allows XML content in fields, leading to potential XML Bomb exploit

• CVSS 7.5
• CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
• Input Validation and Sanitization
• Remote

Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.

CVE

CVE-2020-5227

CWE

CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

CVSS base score

7.5

Published

2020-01-28

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update feedgen to version 0.9.0 or higher.

from feedgen.feed import FeedGenerator


def create_feed_with_xml(xml_content):
    # VULNERABLE: This code is susceptible to xss
    fg = FeedGenerator()
    fg.id('http://example.com')
    fg.title('Example Feed')
    fg.link(href='http://example.com', rel='self')
    fg.description('This is an example feed.')

    entry = fg.add_entry()
    entry.id('http://example.com/entry')
    entry.title('Example Entry')
    entry.content(xml_content, type='html')

    print(fg.atom_str(pretty=True).decode('utf-8'))


xml_bomb = """<!DOCTYPE foo [
    <!ENTITY xxe SYSTEM "file:///dev/random">
    <!ENTITY yxe "&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;">
]>
<root>&yxe;</root>"""

feed_output = create_feed_with_xml(xml_bomb)
print(feed_output)

from feedgen.feed import FeedGenerator
import xml.etree.ElementTree as ET

def create_feed_with_xml(xml_content):
    # SECURE: This version prevents xss
    fg = FeedGenerator()
    fg.id('http://example.com')
    fg.title('Example Feed')
    fg.link(href='http://example.com', rel='alternate')
    
    try:
        parsed_xml = ET.fromstring(xml_content)
        fg.entry(content=ET.tostring(parsed_xml, encoding='unicode'))

    except ET.ParseError as e:
        print(f"XML Parse Error: {e}")

    return fg.atom_str(pretty=True)

xml_bomb = """<!DOCTYPE foo [
    <!ENTITY xxe SYSTEM "file:///dev/random">
    <!ENTITY yxe "&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;">
]>
<root>&yxe;</root>"""

feed_output = create_feed_with_xml(xml_bomb)
print(feed_output)

@misc{vaitp:cve20205227,
  title        = {{XML DoS in pre-0.9.0 Feedgen (Python), allows XML content in fields, leading to potential XML Bomb exploit}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-5227},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-5227/}}
}