CVE-2016-10149: Pysaml2 XML External Entity (XXE) Vulnerability
Summary
CVE-2016-10149: Pysaml2 does not sanitize XML responses. Affects pysaml2 versions < 4.5.0. Fixed in 4.5.0. How to fix ↓
Also tracked for
- python-pysaml2 · Debian:11
The same CVE-2016-10149 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pysaml2 is a Python library that provides support for SAML (Security Assertion Markup Language) authentication and federation. It allows applications to implement SAML-based Single Sign-On (SSO) and Single Logout (SLO) functionality. Pysaml2 is widely used in various Python projects and frameworks for integrating SAML-based authentication.
Vulnerability Detail
The vulnerability identified as CVE-2016-10149 is an XML External Entity (XXE) vulnerability in PySAML2 versions 4.4.0 and earlier. This vulnerability allows remote attackers to read arbitrary files by exploiting a flaw in the handling of SAML XML requests or responses. By crafting a malicious SAML XML document, an attacker can trigger the parsing of external entities, leading to unauthorized access to sensitive files on the server. This can result in the exposure of confidential information or the compromise of the affected system.
How To Fix
Minimum fixed version
4.5.0
This is the first release that contains the fix.
pip install --upgrade "pysaml2==4.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading to the latest version is not immediately feasible, it is recommended to disable the processing of external entities in the XML parser configuration. This can be achieved by modifying the XML parser settings or using a secure XML parser library that automatically prevents XXE attacks. Here is an example of how to disable external entity processing using the defusedxml library:
import defusedxml.ElementTree as ET
xml_data = '<malicious_xml>'
Disable external entity processing
parser = ET.DefusedXMLParser()
Parse the XML data
tree = ET.parse(xml_data, parser=parser)
Process the parsed XML tree
...
Conclusion
In conclusion, the CVE-2016-10149 vulnerability in PySAML2 versions 4.4.0 and earlier exposes applications to XML External Entity (XXE) attacks. To mitigate this risk, it is crucial to upgrade to PySAML2 version 4.5.0 or later, which includes the necessary fixes. Alternatively, you can apply the temporary workaround of disabling external entity processing in the XML parser configuration. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pysaml2 →
FAQ
PySAML2 is a Python library used for implementing SAML-based authentication and federation in Python applications. It provides support for Single Sign-On (SSO) and Single Logout (SLO) functionality.
An XML External Entity (XXE) vulnerability is a type of security flaw that allows an attacker to read arbitrary files on the server by exploiting the processing of external entities in XML documents. In the case of PySAML2, this vulnerability can be triggered by crafting a malicious SAML XML request or response.
Exploiting this vulnerability can lead to unauthorized access to sensitive files on the server, potentially exposing confidential information. It can also be leveraged to compromise the affected system and perform further attacks.
To fix this vulnerability, it is recommended to upgrade to PySAML2 version 4.5.0 or later. This version includes the necessary fixes to prevent XXE attacks. Alternatively, you can disable the processing of external entities in the XML parser configuration as a temporary workaround.
Yes, you can mitigate the risk by disabling the processing of external entities in the XML parser configuration. This can be achieved by modifying the XML parser settings or using a secure XML parser library that automatically prevents XXE attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for pysaml2.
