CVE-2024-36827
📋 TL;DR
An XML External Entity (XXE) vulnerability in ebookmeta's get_metadata function allows attackers to read sensitive files from the server or cause denial of service via malicious XML input. This affects any application using ebookmeta library versions before 1.2.8 to parse untrusted XML data.
💻 Affected Systems
- ebookmeta
📦 What is this software?
Ebookmeta by Dnkorpushov
⚠️ Risk & Real-World Impact
Worst Case
Complete server file disclosure including sensitive configuration files, credentials, or SSH keys, potentially leading to full system compromise.
Likely Case
Limited file disclosure from the application's context, potentially exposing metadata or configuration files, or causing application crashes.
If Mitigated
No impact if XML parsing is disabled for external entities or if input is properly sanitized before processing.
🎯 Exploit Status
XXE vulnerabilities are well-understood with many public exploit examples available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.8
Vendor Advisory: https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335
Restart Required: No
Instructions:
1. Update ebookmeta to version 1.2.8 or later using pip: pip install --upgrade ebookmeta==1.2.8
2. Verify the update completed successfully
3. Test XML parsing functionality
🔧 Temporary Workarounds
Disable XML external entity processing
allConfigure XML parser to disable external entity resolution before parsing untrusted XML
parser = etree.XMLParser(resolve_entities=False)
Input validation and sanitization
allValidate and sanitize XML input before passing to get_metadata function
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy web application firewall with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check ebookmeta version: python -c "import ebookmeta; print(ebookmeta.__version__)"Check Version:
python -c "import ebookmeta; print(ebookmeta.__version__)"Verify Fix Applied:
Verify version is 1.2.8 or higher and test with known XXE payloads📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from XML parsing functions
- Application crashes during XML processing
- Large XML payloads with external entity references
Network Indicators:
- XML payloads containing SYSTEM or PUBLIC declarations
- Requests to internal file paths from XML parsers
SIEM Query:
source="application.logs" AND ("XXE" OR "external entity" OR "DOCTYPE")