Skip to content

Insecure XML Parsing with lxml

Description

The application uses the `lxml.etree` package for processing XML, which suffers from various XML parsing vulnerabilities, including Billion laughs / exponential entity expansion and Quadratic blowup entity expansion, allowing an adversary to cause a Denial of Service (DoS) against the application parsing arbitrary XML.

Examples

Insecure Code

python
import lxml.etree
etree.parse('untrusted_xml.xml')

Secure Code

python
from defusedxml.ElementTree import parse
et = parse('untrusted_xml.xml')

Remediation

Use the `defusedxml` library when processing untrusted XML.

Rule Details

FieldValue
IDCODE-0156
CategoryInjection
SeverityMEDIUM
CWECWE-611
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityMODERATE
Tagsxml, xxe, denial-of-service
OWASPA4:2017-XML External Entities (XXE), A03:2021-Injection