Blind SSRF vulnerability

[traut]

When the content that starts with http:// is passed to libtaxii's parse method, the library executes HTTP GET request, even though no_network is set to True on the XML parser.

Executing

from libtaxii.common import parse
parse("http://test-domain.local?junkdata")

will trigger a GET request to http://test-domain.local?junkdata

This means that maliciously crafted TAXII request can trigger blind SSRF

reproducible in libtaxii v1.1.117

from eclecticiq/OpenTAXII#176

[emmanvg]

Hi @traut, the parse method defined in libtaxii wraps the lxml library etree.parse() or etree.XML() method. I looked at the configuration defined on the OpenTAXII repo and it looks similar to the configuration provided in libtaxii as default when no parser is set get_xml_parser. I would raise this issue to the lxml group and include more information about the finding. Hope this helps!

Homepage - https://lxml.de/

[JasonKeirstead]

https://docs.python.org/3/library/xml.html#the-defusedxml-and-defusedexpat-packages

Might want to leverage https://pypi.org/project/defusedxml/

[orsinium]

CVE-2020-27197