CVE-2019-1010268
📋 TL;DR
This vulnerability in Ladon's SOAP interface allows attackers to perform XML External Entity (XXE) attacks by sending specially crafted SOAP requests. Successful exploitation enables reading arbitrary files from the server and accessing internal network endpoints. All Ladon installations using affected versions with SOAP interfaces exposed are vulnerable.
💻 Affected Systems
- Ladon
📦 What is this software?
Ladon by Ladon Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise including reading sensitive files (passwords, configs), accessing internal network services, and potential remote code execution through file inclusion.
Likely Case
Information disclosure of server files including configuration files, source code, and potentially sensitive data stored on the filesystem.
If Mitigated
Limited impact with proper network segmentation and file system permissions, though information disclosure may still occur.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB (ID: 43113). Attack requires sending a specially crafted SOAP request to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Ladon repository for latest version with XXE fixes
Vendor Advisory: https://bitbucket.org/jakobsg/ladon
Restart Required: Yes
Instructions:
1. Update Ladon to latest version. 2. Verify XXE protection is enabled in SOAP parser configuration. 3. Restart the Ladon service.
🔧 Temporary Workarounds
Disable external entity processing
allConfigure XML parser to disable external entity resolution
Configure XML parser with: resolve_entities=False, no_network=True
Disable SOAP interface
allRemove or disable SOAP endpoints if not required
Comment out or remove SOAP interface configuration in Ladon settings
🧯 If You Can't Patch
- Implement WAF rules to block XXE patterns in SOAP requests
- Network segmentation to isolate Ladon instances from sensitive internal resources
🔍 How to Verify
Check if Vulnerable:
Test by sending a crafted SOAP request with external entity reference to Ladon SOAP endpointsCheck Version:
Check Ladon version in Python: import ladon; print(ladon.__version__)Verify Fix Applied:
Attempt XXE attack after patch/configuration changes - should return error or empty response instead of file contents📡 Detection & Monitoring
Log Indicators:
- Unusual SOAP requests with XML entity declarations
- File read attempts in application logs
- Errors related to XML parsing failures
Network Indicators:
- SOAP requests containing DOCTYPE declarations or external entity references
- Outbound connections from Ladon server to internal resources
SIEM Query:
source="ladon.log" AND ("DOCTYPE" OR "ENTITY" OR "SYSTEM")🔗 References
- https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688
- https://www.exploit-db.com/exploits/43113
- https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688
- https://www.exploit-db.com/exploits/43113
