Skip to content

Improper Restriction of XML External Entity Reference

Description

The application uses the `xml.etree` package for processing XML, which suffers from various XML parsing vulnerabilities, including Billion Laughs and Quadratic Blowup entity expansion attacks. These vulnerabilities can allow an adversary to cause a Denial of Service (DoS) against the application parsing arbitrary XML.

Examples

Insecure Code

python
import xml.etree.ElementTree as ET
et = ET.parse('inventory.xml')

Secure Code

python
from defusedxml.ElementTree import parse
et = parse('inventory.xml')

Remediation

Use the `defusedxml` library when processing untrusted XML. Replace `xml.etree.ElementTree` with `defusedxml.ElementTree`.

Rule Details

FieldValue
IDCODE-0173
CategoryInjection
SeverityMEDIUM
CWECWE-611
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityMODERATE
Tagsxml, xxe, injection
OWASPA4:2017-XML External Entities (XXE), A03:2021-Injection