Executive brief
feedparser is a widely-used library for parsing RSS and Atom feeds in Python applications. A cross-site scripting (XSS) vulnerability in versions 5.0 and 5.0 allows attackers to inject malicious JavaScript or HTML by crafting feeds with malformed XML comments. When a vulnerable application uses feedparser to process untrusted feeds and displays the parsed content in a web browser, an attacker can steal user sessions, credentials, or perform actions on behalf of the user.
Technical details
A cross-site scripting (XSS) vulnerability exists in feedparser.py in Universal Feed Parser versions 5.x before 5.0.1, caused by improper sanitization of XML comments during feed parsing. The vulnerable component fails to properly escape or filter malformed XML comment content before returning it to the caller. An attacker can supply a specially crafted feed containing injected script or HTML within XML comments; if the application displays this parsed content without additional sanitization, the payload executes in the victim's browser. The vulnerability requires user interaction (visiting a page that processes the feed) and network access to the feed source. Patches are available in version 5.0.1 and later.
Affected products
- feedparser feedparser 5.0, 5.0
Timeline
- 2011-03: disclosed: Vulnerability reported to oss-security mailing list
- 2011: patched: Fixed in feedparser 5.0.1
- 2018-07-23: advisory: GitHub advisory GHSA-2p78-8hh6-96xc published