PT-2019-11538 · Ladon · Ladon

Published 2019-07-18 · Updated 2019-07-26 · CVE-2019-1010268

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ladon versions 0.6.1 and later

Description: The issue affects the SOAP request handlers component, allowing for XML External Entity (XXE) attacks. This can lead to information disclosure, enabling attackers to read files and access internal network endpoints. The attack vector involves sending a specially crafted SOAP call.

Recommendations: For versions 0.6.1 and later, consider disabling the SOAP request handlers until a patch is available to prevent exploitation. Restrict access to internal network endpoints to minimize the risk of information disclosure. Avoid using the affected SOAP interface until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-1010268

GHSA-VG35-VC9F-Q7X2

PYSEC-2019-184

Affected Products

Ladon

References · 10

• 🔥 https://exploit-db.com/exploits/43113 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010268 · Security Note
• https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688 · Patch
• https://osv.dev/vulnerability/GHSA-vg35-vc9f-q7x2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-184 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1010268 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/ladon/PYSEC-2019-184.yaml · Note
• https://bitbucket.org/jakobsg/ladon/pull-requests/9 · Note
• https://github.com/advisories/GHSA-vg35-vc9f-q7x2 · Note
• https://bitbucket.org/jakobsg/ladon · Note