Critical XML External Entity Injection in PyWPS: File Exposure Risk
Summary
CVE-2021-39371: An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. Affects pywps versions < 16355299bc3147dd8215d0d13b78c49b4380c50e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyWPS (Python Web Processing Service) is an open-source server that allows users to execute geospatial processes over the web. It is widely used in geospatial applications to provide web services for processing and analyzing geographic data. The package is designed to be extensible and supports various input and output formats. However, a vulnerability has been identified that allows for XML External Entity (XXE) injection, which can lead to unauthorized file access on the server.
Vulnerability Detail
The vulnerability, identified as CVE-2021-39371, arises from improper handling of XML input. An attacker can exploit this weakness by crafting a malicious XML document that includes an external entity reference. This can lead to the disclosure of sensitive files from the server's filesystem, potentially exposing confidential information. The risk is particularly significant in environments where PyWPS is deployed with insufficient security measures, as it can allow attackers to gain access to critical system files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the processing of external entities in XML parsing libraries used by PyWPS. This can typically be done by configuring the XML parser settings to prevent the resolution of external entities. For example, if using Python's lxml library, you can disable external entity processing as follows:
from lxml import etree
parser = etree.XMLParser(resolve_entities=False)
This will help mitigate the risk until the application can be updated.
Conclusion
CVE-2021-39371 presents a significant security risk for users of PyWPS due to its potential for unauthorized file access through XML External Entity injection. It is crucial for users to upgrade to the latest version of the software and consider implementing temporary workarounds to protect their systems until the upgrade can be completed.
See every vulnerability recorded for pywps →
FAQ
CVE-2021-39371 is a vulnerability in PyWPS that allows for XML External Entity (XXE) injection, potentially exposing sensitive files on the server.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files on the server, which may include configuration files, user data, or other confidential information.
Users of PyWPS should upgrade to version 4.5.0-1 or later to mitigate the risk associated with this vulnerability.
Yes, you can disable external entity processing in your XML parser as a temporary workaround until you can upgrade the application.
Related vulnerabilities
Recent vulnerabilities recorded for pywps.
