OWSLib vulnerable to XML External Entity (XXE) Injection
Date: 2023-03
Affected: pip/OWSLib
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-27476
CWE: CWE-611
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L)

### Impact OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution for `lxml`, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. ### Patches - Use only lxml for XML handling, adding `resolve_entities=False` to `lxml`'s parser: https://github.com/geopython/OWSLib/pull/863 ### Workarounds ```python patch_well_known_namespaces(etree) etree.set_default_parser( parser=etree.XMLParser(resolve_entities=False) ) ``` ### References - [`GHSL-2022-131`](https://securitylab.github.com/advisories/GHSL-2022-131_OWSLib/)


Mitigations:

Architectural layers (MAESTRO):