Commit c086cb13 authored by Martin Szulecki's avatar Martin Szulecki

xplist: Fix limited but possible XXE security vulnerability with XML plists

By using a specifically crafted XML file an attacker could use plistutil
to issue a GET request to an arbitrary URL or disclose a local file.
The crafted XML file would be using a custom DTD with an external entity
reference pointing to the file. Practical abuse is limited but let's still
fix it nevertheless. Related to CVE-2013-0339 for libxml2 and CWE-827.
Reported by Loïc Bénis from calypt.com. Thanks!
parent 82a6acc4
...@@ -29,6 +29,7 @@ ...@@ -29,6 +29,7 @@
#include <inttypes.h> #include <inttypes.h>
#include <locale.h> #include <locale.h>
#include <libxml/xmlIO.h>
#include <libxml/parser.h> #include <libxml/parser.h>
#include <libxml/tree.h> #include <libxml/tree.h>
...@@ -555,11 +556,22 @@ PLIST_API void plist_to_xml(plist_t plist, char **plist_xml, uint32_t * length) ...@@ -555,11 +556,22 @@ PLIST_API void plist_to_xml(plist_t plist, char **plist_xml, uint32_t * length)
} }
} }
static xmlParserInputPtr plist_xml_external_entity_loader(const char *URL, const char *ID, xmlParserCtxtPtr ctxt)
{
return NULL;
}
PLIST_API void plist_from_xml(const char *plist_xml, uint32_t length, plist_t * plist) PLIST_API void plist_from_xml(const char *plist_xml, uint32_t length, plist_t * plist)
{ {
xmlDocPtr plist_doc = xmlParseMemory(plist_xml, length); /* CVE-2013-0339: disable external entity loading to prevent XXE vulnerability */
xmlNodePtr root_node = xmlDocGetRootElement(plist_doc); xmlSetExternalEntityLoader(plist_xml_external_entity_loader);
xml_to_node(root_node, plist); /* read XML from memory and disable network access for security reasons */
xmlFreeDoc(plist_doc); xmlDocPtr plist_doc = xmlReadMemory(plist_xml, length, "plist_from_xml:memory", NULL, XML_PARSE_NONET);
if (plist_doc) {
xmlNodePtr root_node = xmlDocGetRootElement(plist_doc);
xml_to_node(root_node, plist);
xmlFreeDoc(plist_doc);
}
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment