Get the latest tech news
Defusedxml – defusing XML bombs and other exploits
Contribute to tiran/defusedxml development by creating an account on GitHub.
An attacker can abuse a vulnerable XML library and application to rebound and forward network requests with the IP address of the server. An attacker can circumvent firewalls and gain access to restricted resources as all the requests are made from an internal and trustworthy IP address, not from the outside. (thanks to Florian Apolloner) Add demo exploit for external entity attack on Python's SAX parser, XML-RPC and WebDAV.
Or read this on Hacker News
