XSS Vulnerability in Python XML-RPC Server - CVE-2019-16935
Summary
UBUNTU-CVE-2019-16935: The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm3. Fixed in 2.7.6-8ubuntu0.6+esm3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is commonly used for web development, data analysis, artificial intelligence, and more. The XML-RPC server in Python facilitates remote procedure calls over HTTP, allowing clients to execute functions on a server. However, a vulnerability has been identified in this server that can lead to cross-site scripting (XSS) attacks, compromising the security of applications that utilize it.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16935, exists in the documentation XML-RPC server of Python versions up to 2.7.16, 3.x up to 3.6.9, and 3.7.x up to 3.7.4. It arises from improper handling of the 'server_title' field, which can be exploited if untrusted input is passed to the 'set_server_title' function. This flaw allows attackers to inject arbitrary JavaScript code, which can be executed by clients accessing the server, potentially leading to data theft, session hijacking, or other malicious activities.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid using the XML-RPC server with untrusted input. Ensure that the 'server_title' is set only with trusted data to mitigate the risk of XSS attacks.
Conclusion
CVE-2019-16935 is a significant vulnerability in the Python XML-RPC server that can lead to XSS attacks if not addressed. Users are encouraged to update their Python packages to the latest patched versions and implement workarounds to safeguard their applications.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2019-16935 is a vulnerability in the Python XML-RPC server that allows for cross-site scripting (XSS) attacks via the 'server_title' field.
The vulnerability affects Python versions up to 2.7.16, 3.x up to 3.6.9, and 3.7.x up to 3.7.4.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring signup.
If exploited, this vulnerability can lead to data theft, session hijacking, and other malicious actions by executing arbitrary JavaScript in the client's browser.
Yes, patched versions of the affected Python packages are available. It is recommended to update to these versions to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
