{"id":"GHSA-7r9x-qrpr-3cxw","aliases":[],"status":"published","title":"mofh Vulnerable to Improper Restriction of XML External Entity Reference","description":"The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:\n\n- [Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack): It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed.  \n- [Quadratic blowup attack](https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/): It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.\n\nThe Problem has been patched starting from version `1.0.1` by utilising the `defusedxml` package instead of `xml.etree.ElementTree`.\n\n### Workarounds\nFor this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the `api_url` argument, or MyOwnFreeHost's API must be hacked. So, if the user did not use a custom API URL they _should_ be fine, however, upgrading is still advised.\n\nAnother workaround could be to call `defusedxml.defuse_stdlib()` before making any requests using the client.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2022-08-11T18:06:05Z","modified":"2024-12-03T06:07:30Z","fixes":[{"ecosystem":"PyPI","package":"mofh","fixed_in":["1.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mofh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mofh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","1.0.0"]}],"references":[{"url":"https://github.com/Wallvon/mofh/security/advisories/GHSA-7r9x-qrpr-3cxw","tags":["web"]},{"url":"https://github.com/Wallvon/mofh/commit/da0d33cfd368e2f237ab28bf7a7f00e3d281005a","tags":["web"]},{"url":"https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/"},{"url":"https://github.com/advisories/GHSA-7r9x-qrpr-3cxw"},{"url":"https://github.com/Wallvon/mofh","tags":["package"]},{"url":"https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-7r9x-qrpr-3cxw","title":"mofh Vulnerable to Improper Restriction of XML External Entity Reference","description":"The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:\n\n- [Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack): It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed.  \n- [Quadratic blowup attack](https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/): It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.\n\nThe Problem has been patched starting from version `1.0.1` by utilising the `defusedxml` package instead of `xml.etree.ElementTree`.\n\n### Workarounds\nFor this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the `api_url` argument, or MyOwnFreeHost's API must be hacked. So, if the user did not use a custom API URL they _should_ be fine, however, upgrading is still advised.\n\nAnother workaround could be to call `defusedxml.defuse_stdlib()` before making any requests using the client.","status":"published","published":"2022-08-11T18:06:05Z","modified":"2023-01-07T05:07:56Z","cwes":["CWE-611"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-7r9x-qrpr-3cxw","title":"mofh Vulnerable to Improper Restriction of XML External Entity Reference","description":"The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:\n\n- [Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack): It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed.  \n- [Quadratic blowup attack](https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/): It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.\n\nThe Problem has been patched starting from version `1.0.1` by utilising the `defusedxml` package instead of `xml.etree.ElementTree`.\n\n### Workarounds\nFor this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the `api_url` argument, or MyOwnFreeHost's API must be hacked. So, if the user did not use a custom API URL they _should_ be fine, however, upgrading is still advised.\n\nAnother workaround could be to call `defusedxml.defuse_stdlib()` before making any requests using the client.","status":"published","published":"2022-08-11T18:06:05Z","modified":"2024-12-03T06:07:30.576416Z","cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:41.349637Z"}]}}