Critical XML External Entity (XXE) Vulnerability in PySAML2 Package
Summary
CVE-2016-10149: XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response. Affects python-pysaml2 across 3 version ranges.
< 3.0.0-5
< 6e09a25d9b4b7aa7a506853210a9a14100b8bc9b
< 78261b9ae13c3855b33009cb1c5abc2c45839828
Fixed in 3.0.0-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PySAML2 is a Python library that provides support for SAML (Security Assertion Markup Language) authentication. It is widely used in applications requiring secure identity management and single sign-on capabilities. The library facilitates the exchange of authentication and authorization data between parties, particularly in web services. However, versions 4.4.0 and earlier are vulnerable to an XML External Entity (XXE) attack, which can lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from improper handling of XML input in PySAML2, allowing remote attackers to exploit the XXE flaw through crafted SAML XML requests or responses. This can lead to the disclosure of arbitrary files on the server, potentially exposing sensitive information. The vulnerability is particularly concerning as it can be exploited without authentication, making it a high-risk issue for applications using affected versions of the library.
How To Fix
Minimum fixed version
3.0.0-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pysaml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider disabling XML entity processing in your application. This can be done by modifying the XML parser settings to prevent external entities from being processed. For example, if using lxml, you can disable DTD processing as follows:
from lxml import etree
parser = etree.XMLParser(load_dtd=False)
This will help mitigate the risk until a proper upgrade can be performed.
Conclusion
The XXE vulnerability in PySAML2 poses a significant risk to applications using the library. Upgrading to a secure version is crucial to protect sensitive data from unauthorized access. Users are encouraged to implement the recommended fixes and utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for python-pysaml2 →
FAQ
An XXE vulnerability allows an attacker to interfere with the processing of XML data, potentially leading to the disclosure of sensitive files or server-side request forgery.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Check your manifest file against known vulnerabilities.
Failure to address this vulnerability can lead to unauthorized access to sensitive files, which may result in data breaches and compliance issues.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for python-pysaml2.
