SOAPpy 0.12.5 XXE / Denial Of Service

2014.05.07

Credit: pnig0s

Risk: Medium

Local: Yes

Remote: No

CVE: N/A

CWE: N/A

*Background*
SOAPpy provides tools for building SOAP clients and servers.The goal of the SOAPpy team is to provide a full featured SOAP library for Python that is very simple to use and that fully supports dynamic interaction between clients and servers.
SOAPpy use sax.xml as SOAP parser to parse the xml request.Sax.xml also support of setting a handler for resolving entity.By tricking this feature,it'll lead to xxe attack or dtd dos attack.
*Vulnerability details*
Affect version: 0.12.5(currently the lastest version)
Type: XXE Attack & Billion laughs attack
*More details*
http://www.pnigos.com/?p=260
===========================================
This bug was found by pnig0s@freebuf.com.

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

SOAPpy 0.12.5 XXE / Denial Of Service

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.