xml2rfc has file inclusion irregularities
Date: 2025-02
Affected: pip/xml2rfc
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-22

Version [3.12.0](https://github.com/ietf-tools/xml2rfc/blob/main/CHANGELOG.md#3120---2021-12-08) changed `xml2rfc` so that it would not access local files without the presence of its new `--allow-local-file-access` flag. This prevented XML External Entity (XXE) injection attacks with `xinclude` and XML entity references. It was discovered that `xml2rfc` does not respect `--allow-local-file-access` when a local file is specified as `src` in `artwork` or `sourcecode` elements. Furthermore, XML entity references can include any file inside the source dir and below without using the `--allow-local-file-access` flag. The `xml2rfc <= 3.26.0` behaviour: | | `xinclude` | XML entity reference | `artwork src=` | `sourcecode src=` | |---|---|---|---|---| | without `--allow-local-file-access` flag | No filesystem access | Any file in xml2rfc templates dir and below, any file in source directory and below | Access source directory and below | Access source directory and below | | with `--allow-local-file-access` flag | Access any file on filesystem[^1] | Access any file on filesystem[^1] | Access source directory and below | Access source directory and below | Access source directory and below | [^1]: Access any file of the filesystem with the permissions of the user running `xml2rfc` can access. ### Impact Anyone running `xml2rfc` as a service that accepts input from external users is impacted by this issue. Specifying a file in `src` attribute in `artwork` or `sourcecode` elem


Mitigations:

Architectural layers (MAESTRO):