Executive brief
python-docx is a Python library used to create and modify Microsoft Word documents. The library did not properly restrict XML External Entity (XXE) processing when parsing document files, allowing attackers to conduct XXE attacks through specially crafted Word documents. Exploitation could lead to information disclosure, denial of service, or remote code execution depending on the server configuration and available resources.
Technical details
The vulnerability is an XML External Entity (XXE) injection flaw (CWE-611) in the XML parsing logic used by python-docx versions before 0.8.6. The vulnerable component is the oxml_parser, which was resolving XML entities during document parsing without proper restrictions. An attacker can supply a malicious .docx file with crafted XML entities to trigger XXE attacks; the attack requires user interaction (opening the malicious document). The fix disables entity resolution in both the OPC package parser and the part parser, as entity resolution is not required by the Open XML specification. The patch was released in version 0.8.6.
Affected products
- python-docx python-docx < 0.8.6
Timeline
- 2022-05-13: disclosed: Advisory published on GitHub
- 0.8.6: patched: Fix released disabling XML entity resolution