CVE-2019-1010268: XML External Entity (XXE) in ladon
Summary
CVE-2019-1010268: Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). Affects ladon versions >= 0.6.1, < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ladon is an open-source Python package available on PyPI. It is used for SOAP request handling and provides various functionalities for web services. The package has been vulnerable to XML External Entity (XXE) attacks since version 0.6.1. This vulnerability allows an attacker to disclose sensitive information, read files, and potentially reach internal network endpoints by exploiting the SOAP request handlers.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in Ladon arises due to the lack of proper input validation and handling of XML data. An attacker can send a specially crafted SOAP call to trigger the vulnerability. This can lead to information disclosure, file reading, and potential access to internal network endpoints. The vulnerable component can be found in the SOAP request handlers of Ladon, specifically in the 'soap.py' file.
How To Fix
Minimum fixed version
1.0.0
This is the first release that contains the fix.
pip install --upgrade "ladon==1.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the fixed version of Ladon as soon as possible.
Conclusion
The Ladon package has been vulnerable to XML External Entity (XXE) attacks, which can lead to information disclosure and potential access to internal network endpoints. It is crucial to update to the fixed version of Ladon (1.0.0 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ladon →
FAQ
Ladon is an open-source Python package used for SOAP request handling and web services.
XML External Entity (XXE) vulnerability is a type of attack that exploits the improper handling of XML input, allowing an attacker to read files, disclose sensitive information, and potentially access internal network endpoints.
An attacker can exploit this vulnerability by sending a specially crafted SOAP call to the vulnerable SOAP request handlers in Ladon.
The potential impacts of this vulnerability include information disclosure, file reading, and potential access to internal network endpoints.
To fix this vulnerability, update Ladon to version 1.0.0 or later, as the developers have addressed the issue in the newer versions.
