CVE-2020-26705

Vulnerability

The parseXML function in Easy-XML 0.5.0 is vulnerable to XML External Entity (XXE) processing due to the lack of proper disabling of external entity resolution during parsing. An attacker can inject a malicious XML payload containing an external entity reference that points to a local file or a network resource. This issue exists in the Python package easy-xml version 0.5.0 as referenced in the PyPA advisory database [3]. The vulnerability is triggered when a user or application calls parseXML with untrusted XML content.

Exploitation

An attacker needs to supply a crafted XML payload to the parseXML function. This can be achieved by providing the malicious XML as input to any application that uses the vulnerable function and processes user-supplied XML. The attacker does not need authentication or special privileges if the application accepts XML from external sources. The exploitation involves embedding an external entity definition within the XML document, such as <!ENTITY xxe SYSTEM "file:///etc/passwd"> and then referencing that entity in the document body. When parseXML processes the XML, it resolves the external entity, leading to the inclusion of the targeted file content or causing a denial of service if the external resource is large or slow [1][2].

Impact

Successful exploitation allows an attacker to read sensitive data from the server's file system, such as configuration files or credentials, leading to information disclosure. Additionally, an attacker can cause a denial of service (DoS) by making the parser load a large external entity or initiate requests to external resources that consume server resources. The impact is limited to the scope of the file system and network reachable by the vulnerable application process [1][2].

Mitigation

As of the available references, Easy-XML 0.5.0 is marked as affected, and no patched version has been officially released for Python. The PyPA advisory database lists the vulnerability but does not provide a fix version [3]. Developers should avoid using the parseXML function with untrusted XML input. If upgrading is not possible, a workaround is to parse XML with a safe library (e.g., defusedxml) that disables external entity processing by default. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.