org.sonar.l10n.py.rules.python.S2755.html Maven / Gradle / Ivy
This vulnerability allows the usage of external entities in XML.
Why is this an issue?
External Entity Processing allows for XML parsing with the involvement of external entities. However, when this functionality is enabled without
proper precautions, it can lead to a vulnerability known as XML External Entity (XXE) attack.
What is the potential impact?
Exposing sensitive data
One significant danger of XXE vulnerabilities is the potential for sensitive data exposure. By crafting malicious XML payloads, attackers can
reference external entities that contain sensitive information, such as system files, database credentials, or configuration files. When these
entities are processed during XML parsing, the attacker can extract the contents and gain unauthorized access to sensitive data. This poses a severe
threat to the confidentiality of critical information.
Exhausting system resources
Another consequence of XXE vulnerabilities is the potential for denial-of-service attacks. By exploiting the ability to include external entities,
attackers can construct XML payloads that cause resource exhaustion. This can overwhelm the system’s memory, CPU, or other critical resources, leading
to system unresponsiveness or crashes. A successful DoS attack can disrupt the availability of services and negatively impact the user experience.
Forging requests
XXE vulnerabilities can also enable Server-Side Request Forgery (SSRF) attacks. By leveraging the ability to include external entities, an attacker
can make the vulnerable application send arbitrary requests to other internal or external systems. This can result in unintended actions, such as
retrieving data from internal resources, scanning internal networks, or attacking other systems. SSRF attacks can lead to severe consequences,
including unauthorized data access, system compromise, or even further exploitation within the network infrastructure.
How to fix it in Python Standard Library
Code examples
The following code contains examples of XML parsers that have external entity processing enabled. As a result, the parsers are vulnerable to XXE
attacks if an attacker can control the XML file that is processed.
Noncompliant code example
import xml.sax
parser = xml.sax.make_parser()
myHandler = MyHandler()
parser.setContentHandler(myHandler)
parser.setFeature(feature_external_ges, True) # Noncompliant
parser.parse('xxe.xml')
Compliant solution
The SAX parser does not process general external entities by default since version 3.7.1.
import xml.sax
parser = xml.sax.make_parser()
myHandler = MyHandler()
parser.setContentHandler(myHandler)
parser.setFeature(feature_external_ges, False)
parser.parse('xxe.xml')
How does this work?
Disable external entities
The most effective approach to prevent XXE vulnerabilities is to disable external entity processing entirely, unless it is explicitly required for
specific use cases. By default, XML parsers should be configured to reject the processing of external entities. This can be achieved by setting the
appropriate properties or options in your XML parser library or framework.
If external entity processing is necessary for certain scenarios, adopt a whitelisting approach to restrict the entities that can be resolved
during XML parsing. Create a list of trusted external entities and disallow all others. This approach ensures that only known and safe entities are
processed.
You should rely on features provided by your XML parser to restrict the external entities.
How to fix it in lxml
Code examples
The following code contains examples of XML parsers that have external entity processing enabled. As a result, the parsers are vulnerable to XXE
attacks if an attacker can control the XML file that is processed.
Noncompliant code example
When parsing XML:
from lxml import etree
parser = etree.XMLParser() # Noncompliant
tree = etree.parse('xxe.xml', parser)
root = tree1.getroot()
When validating XML:
from lxml import etree
parser = etree.XMLParser(resolve_entities=True) # Noncompliant
treexsd = etree.parse('xxe.xsd', parser)
rootxsd = treexsd.getroot()
schema = etree.XMLSchema(rootxsd)
When transforming XML:
from lxml import etree
ac = etree.XSLTAccessControl(read_network=True, write_network=False) # Noncompliant
transform = etree.XSLT(rootxsl, access_control=ac)
Compliant solution
When parsing XML, disable entity resolving and network access:
from lxml import etree
parser = etree.XMLParser(resolve_entities=False, no_network=True)
tree1 = etree.parse('xxe.xml', parser)
root1 = tree1.getroot()
When validating XML (note that network access cannot be completely disabled when calling
XMLSchema):
from lxml import etree
parser = etree.XMLParser(resolve_entities=False)
treexsd = etree.parse('xxe.xsd', parser)
rootxsd = treexsd.getroot()
schema = etree.XMLSchema(rootxsd)
When transforming XML, disable access to network and file system:
from lxml import etree
parser = etree.XMLParser(resolve_entities=False)
treexsl = etree.parse('xxe.xsl', parser)
rootxsl = treexsl.getroot()
ac = etree.XSLTAccessControl.DENY_ALL
transform = etree.XSLT(rootxsl, access_control=ac)
How does this work?
Disable external entities
The most effective approach to prevent XXE vulnerabilities is to disable external entity processing entirely, unless it is explicitly required for
specific use cases. By default, XML parsers should be configured to reject the processing of external entities. This can be achieved by setting the
appropriate properties or options in your XML parser library or framework.
If external entity processing is necessary for certain scenarios, adopt a whitelisting approach to restrict the entities that can be resolved
during XML parsing. Create a list of trusted external entities and disallow all others. This approach ensures that only known and safe entities are
processed.
You should rely on features provided by your XML parser to restrict the external entities.
Resources
Standards
- OWASP - Top 10 2021 Category A5 - Security Misconfiguration
- OWASP - Top 10 2017 Category A4 - XML External
Entities (XXE)
- CWE - CWE-611 - Information Exposure Through XML External Entity Reference
- CWE - CWE-827 - Improper Control of Document Type Definition
- STIG Viewer - Application Security and
Development: V-222608 - The application must not be vulnerable to XML-oriented attacks.