CVE-2024-37388
📋 TL;DR
This XXE vulnerability in ebookmeta's lxml library allows attackers to read sensitive files from the server or cause denial of service by processing malicious XML input. It affects applications using ebookmeta's get_metadata function with vulnerable lxml versions. Any system processing untrusted XML through this function is at risk.
💻 Affected Systems
- ebookmeta
- lxml
📦 What is this software?
Ebookmeta by Dnkorpushov
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system disclosure including sensitive configuration files, credentials, and system files leading to full compromise.
Likely Case
Partial file disclosure from web-accessible directories and potential DoS through resource exhaustion.
If Mitigated
Limited impact with proper XML parsing restrictions and input validation in place.
🎯 Exploit Status
Simple XXE payloads work directly. Proof of concept available in GitHub issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: lxml 4.9.1
Vendor Advisory: https://github.com/dnkorpushov/ebookmeta/issues/16
Restart Required: No
Instructions:
1. Update lxml: pip install --upgrade lxml>=4.9.1
2. Verify ebookmeta uses updated lxml
3. Test XML parsing functionality
🔧 Temporary Workarounds
Disable XXE in lxml
allConfigure lxml parser to disable external entity resolution
parser = etree.XMLParser(resolve_entities=False, no_network=True)
Input validation
allReject XML containing DOCTYPE declarations or external entities
if '<!DOCTYPE' in xml_input: raise ValueError('DOCTYPE not allowed')
🧯 If You Can't Patch
- Implement WAF rules to block XML with DOCTYPE declarations
- Isolate ebookmeta processing to container with minimal file access
🔍 How to Verify
Check if Vulnerable:
Check lxml version: python -c "import lxml; print(lxml.__version__)" and verify if <4.9.1Check Version:
python -c "import lxml; print(lxml.__version__)"Verify Fix Applied:
Test with known XXE payload after update - should not disclose files📡 Detection & Monitoring
Log Indicators:
- XML parsing errors
- File access attempts from XML parser
- Large XML file processing
Network Indicators:
- HTTP requests with XML containing DOCTYPE or SYSTEM entities
- Outbound connections from XML parser
SIEM Query:
source="web_logs" AND ("<!DOCTYPE" OR "SYSTEM" OR "ENTITY") AND dest_port=80