Executive brief
SOAPpy is a Python library for SOAP (Simple Object Access Protocol) web service communication. A flaw in entity expansion handling allows attackers to cause denial of service by sending crafted SOAP requests that consume excessive memory and CPU resources, disrupting service availability.
Technical details
SOAPpy 0.12.5 and earlier fails to properly detect recursive entity expansion during XML parsing, enabling an XML External Entity (XXE) style attack. An attacker can send a SOAP request containing a large number of nested entity references that causes exponential expansion, consuming system memory and CPU without bound. The vulnerability is network-reachable and requires no authentication. The attack results in denial of service; remote code execution or data exfiltration is not possible. The flaw was fixed in version 0.12.6.
Affected products
- SOAPpy SOAPpy 0.12.5 and earlier
Timeline
- 2014-05-12: disclosed
- 2014: patched: Fixed in version 0.12.6
- 2022-05-17: advisory: GHSA advisory published