Listen to this Post
This vulnerability in peppol-py arises from an insecure default configuration of the Saxon HE XML parser used for validating XML invoices. When processing untrusted XML input, the parser’s settings do not restrict the resolution of external entities. An attacker can craft a malicious invoice file containing a specially crafted Document Type Definition (DTD) with an external entity reference pointing to a local file (e.g., file:///etc/passwd) or a remote URL. During the validation process, the parser will resolve this entity, read the specified file, and potentially exfiltrate its contents within the parsed XML structure or through out-of-band channels, leading to unauthorized file disclosure from the server’s filesystem.
DailyCVE Form:
Platform: Peppol Python library
Version: Before 1.1.1
Vulnerability: XML External Entity
Severity: Moderate
Date: 2025-12-01
Prediction: Patch available
What Undercode Say:
Check Saxon version in use python -c "import saxonc; print(saxonc.<strong>version</strong>)" Example vulnerable validation call from peppol.validation import validate validate(xml_data) xml_data contains malicious XXE Sample malicious XML payload malicious_xml = """<?xml version="1.0"?> <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <invoice>&xxe;</invoice>"""
How Exploit:
Attacker sends a crafted PEPPOL invoice XML containing a malicious DTD. The Saxon parser, configured to resolve external entities, reads sensitive server files (e.g., /etc/passwd, configuration files) and includes their content in the validation output or error messages, which may be returned to the attacker.
Protection from this CVE:
Upgrade to peppol-py version 1.1.1 or later, which configures the Saxon parser to disable external entity resolution. If immediate upgrade is not possible, manually configure the Saxon processor to use secure settings: `Feature.ENABLE_EXTERNAL_ENTITIES` set to `false` and `Feature.ENABLE_EXTERNAL_DTD` set to false.
Impact:
Unauthorized local file disclosure, potential server-side request forgery (SSRF), leading to information leakage and system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
