XSS Vulnerability in Python XML-RPC Server - CVE-2019-16935
Summary
ALPINE-CVE-2019-16935: The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. Affects python2 versions < 2.7.16-r3. Fixed in 2.7.16-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively used for web development, data analysis, artificial intelligence, and more. The XML-RPC server in Python allows remote procedure calls using XML, making it easier for applications to communicate over the web. However, certain versions of Python are vulnerable to an XSS attack due to improper handling of user input in the server_title field.
Vulnerability Detail
The vulnerability identified as CVE-2019-16935 affects the documentation XML-RPC server in Python versions up to 2.7.16 and 3.x versions up to 3.7.4. It allows an attacker to exploit the server_title field by injecting arbitrary JavaScript code. If the set_server_title method is called with untrusted input, this malicious script can be executed in the browsers of clients accessing the server, leading to potential data theft or session hijacking.
How To Fix
Minimum fixed version
2.7.16-r3
This is the first release that contains the fix.
sudo apk add --upgrade python2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the XML-RPC server or ensure that the server_title is set to a safe, hardcoded value that does not include user input. Additionally, consider implementing input validation and sanitization to prevent untrusted data from being processed.
Conclusion
CVE-2019-16935 is a significant vulnerability affecting certain versions of the Python XML-RPC server, allowing for XSS attacks through improper handling of user input. It is crucial for users to update their Python packages to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for python2 →
FAQ
CVE-2019-16935 is a vulnerability in the Python XML-RPC server that allows for cross-site scripting (XSS) attacks through the server_title field.
The vulnerability affects Python versions up to 2.7.16 and 3.x versions up to 3.7.4.
Exploiting this vulnerability can lead to arbitrary JavaScript execution in clients' browsers, resulting in data theft, session hijacking, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2019-16935 is 6.1, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
