Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-25082

CVE-2018-25082:
weixin-python XML External Entity vulnerability

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2018-25082
GHSA ID
GHSA-h384-ph77-3699
EPSS Score
0.26652%
CWE
CWE-611
Published
3/21/2023
Updated
10/20/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
weixin-pythonpip< 0.5.50.5.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure XML parsing in two locations: 1) msg.py's parse method handled incoming XML messages without disabling entity resolution. 2) pay.py's to_dict method processed payment XML data with the same vulnerable pattern. The patch explicitly adds 'resolve_entities=False' to XMLParser in both locations, confirming these were the vulnerable entry points. Both functions directly process external XML input and matched the vulnerability description's reference to 'validate/to_xml' functionality.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in zw*zou W****t S*K Pyt*on *.*.* *n* *l*ssi*i** *s *riti**l. T*is issu* *****ts t** *un*tion v*li**t*/to_xml. T** m*nipul*tion l***s to xml *xt*rn*l *ntity r***r*n**. T** *tt**k m*y ** initi*t** r*mot*ly. Up*r**in* to v*rsi

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* XML p*rsin* in two lo**tions: *) ms*.py's p*rs* m*t*o* **n*l** in*omin* XML m*ss***s wit*out *is**lin* *ntity r*solution. *) p*y.py's to_*i*t m*t*o* pro**ss** p*ym*nt XML **t* wit* t** s*m* vuln*r**l* p*tt*rn. T*