Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-47514: XML-RPC.Net - Downloads

An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.

CVE
#vulnerability#web#windows#microsoft#linux#c++#ssrf#auth

Downloads****Current Production Release

XML-RPC.NET 2.5.0 is the current production release.

xml-rpc.net.2.5.0.zip documentation

New features, changes, and fixed issues:

  • Added <i8> to support 64-bit long integer values.
  • Added support for more ISO8601 date formats. AllowNonStandardDateTime flag is now deprecated. The following formats are now accepted by default, with the '-' and ‘:’ separators being optional.
    • yyyy-mm-ddThh:mm:ss
    • yyyy-mm-ddThh:mm:ssZ
    • yyyy-mm-ddThh:mm:ss�hh
    • yyyy-mm-ddThh:mm:ss�hh:mmNote: the XML-RPC spec describes the format as 19980717T14:08:55.
  • Added AllowAutoRedirect property to IXmlRpcProxy. Default behaviour remains the same (property set to true).
  • Moved to Visual Studio 2008.
  • Discontinued support for .NET 1.0 and 1.1.
  • Fixed issues:
    • Issue 55 : change XmlRpcProxyGen so that FileIOPermission is not required for calls to Create.
    • Issue 56: Maintain XML-RPC struct member ordering in XmlRpcStruct after deserialization.
    • Issue 65: When deserializing request, check that the number of parameters is consistent with the method signature.
    • Issue 70: Allow structs/classes to have members or arrays of the same type as the parent type.

Work in Progress

This is a snapshot of work in progress.

xml-rpc.net.3.0.0.270-snapshot.zip documentation

Build 270

  • More graceful handling of case where illegal XML characters are rejected during serialization and deserialization.
  • Added generic EndInvoke method to XmlRpcClientProtocol so return type can be used for deserialization.
  • Added support for cookie and response headers for Silverlight and Windows Phone.

Build 266

  • Support for easier logging of request and response XML.
  • Support for mapping .NET enums to/from XML-RPC string values using XmlRpcEnumMapping attribute.
  • Fixed problem with logging and decompression of response stream.
  • Fixed problem with return type in XmlRpcClientProtocol.EndInvoke.
  • Added unit testing for Silverlight build.
  • Switch to Silverlight 4 only in order to support credentials using ClientHttp stack.
  • Now throws XmlRpcUnsupportedTypeException when a type has an indexer property.

Build 241

  • Fixes problem with mapping <nil /> onto type Object.

Build 238

  • Support for <nil> XML-RPC extension.
  • Support for Silverlight 3 and 4.
  • Support for Windows Phone 7.
  • .NET enum types can be mapped to/from XML-RPC <i4> and <i8> values. (more)
  • New UseEmptyElementTags property on IXmlRpcProxy. If this is set to true full element tags will be generated, for example <string></string> instead of <string />. The default setting of false for this property results is consistent with previous releases. This new feature provides compatibility with servers implemented with XML-RPC libraries which don’t support empty tags, such XMLRPC++.
  • New UseNagleAlgorithm property on IXmlRpcProxy. With its default value of false calls will be quicker where small XML-RPC requests are being sent.
  • Separate client and server assemblies � client assembly compatible with .NET Client Profile.
  • Changed directory structure within distribution zip file to avoid problem when opening the file in Windows Explorer.
  • Moved to Visual Studio 2010.
  • Fixed issues:
    • Issue 55 : change XmlRpcProxyGen so that FileIOPermission is not required for calls to Create.
    • Issue 56: Maintain XML-RPC struct member ordering in XmlRpcStruct after deserialization.
    • Issue 65: When deserializing request, check that the number of parameters is consistent with the method signature.
    • Issue 70: Allow structs/classes to have members or arrays of the same type as the parent type.
    • Issue 74: Fixed case where if a proxy call is made with a ResponseEvent assigned, the call crashes with a “Stream Closed” error.
    • Issue 77: Fixed exception when AllowStringFaultCode is set to true. Now string fault codes are handled as well as integer fault code by default.
    • Issue 78: XmlRpcServiceInfo.GetXmlRpcType now handles case of NonSerializedAttribute on all types.
    • Issue 83: Change to prevent internal server error when viewing auto-generated help on Mono based servers.
    • Issue 86: XmlRpcDocWriter.WriteStruct now writes XmlRpcMember.Description.
    • Issue 89: Workaround on XmlRpcListenerService for cases where closing the request stream was resulting in an InvalidOperationException.
  • Changes:
    • Custom nullable types � XmlRpcBoolean, XmlRpcDateTime, XmlRpcDouble, XmlRpcInt � have been discontinued. Use the standard nullable types bool?, DateTime?, double?, int?.
    • A server implementation now needs to reference the CookComputing.XmlRpcServer assembly in addition to the CookComputing.XmlRpc assembly.
    • Default value for new UseNagleAlgorithm. By default it was previously always false.

Older Releases****2.4.0

xml-rpc.net.2.4.0.zip

New feature and fixed issues:

  • New StructParams property on XmlRpcMethodAttribute which provides supports for APIs which use a struct to provide named parameters to a method call. (more).
  • NonSerialized attribute can be applied to struct members to prevent them being serialized and deserialized. (more).
  • Fixed issues:
    • Issue 25: NullReferenceException when struct member name is an empty string. Now throws XmlRpcInvalidXmlRpcException.
    • Issue 26: Auto-Documentation does not work with HttpListener.
    • Issue 27: XmlRpcListenerService.ProcessRequest may not close stream in case of exception.
    • Issue 28: XmlRpcSerializer.GetStructName does not check for Properties.
    • Issue 31: UseIntTag is being ignored.
    • Issue 32: XmlRpcClientProtocol problem with response from void method.
    • Issue 34: XmlRpcServerProtocol should be derived from MarshalByRefObject. The system.* methods do not work with remoting object.
    • Issue 35: UseEmptyParamsTag property on the proxy doesn�t work unless you are making asynchronous calls.
    • Issue 36: Fixed SelectSingleNode and using statement in XmlRpcFaultException for Compact Framework version.
    • Issue 38: Check of ParamArrayAttribute causes crash under Mono/Linux.
    • Issue 40: Deserialization performance enhancement.

2.3.2

xml-rpc.net.2.3.2.zip

Changes:

  • Issue 22: XmlRpcTypeMismatchException thrown if an XML-RPC array is mistakenly mapped onto a .Net struct (was throwing MissingMethodException).
  • Issue 23: Fixes problem where XML-RPC string values containing just one or more spaces were deserialized as an empty .Net string value.
  • Issue 24: XmlRpcV2 assembly is now built with a strong name.

2.3.1

xml-rpc.net.2.3.1.zip

Changes:

  • Issue 20: Fixes problem where XML-RPC service implemented as HttpHandler returns 500 server error.
  • Issue 21: Fixes problem with StateNameServer sample which returns fault response because of duplicate XML-RPC method names.

2.3.0

xml-rpc.net.2.3.0.zip

New features and changes:

  • Issue 15: Support for accessing response headers and cookies. (more).
  • Issue 17: Support for not sending a params element if no method parameters. (more).
  • Changes:
    • Issue 16: Content type set before writing to response stream (fixes Mono issue).
    • Issue 18: Modified proxy code generation so that it verifies - prevents �Operation could destabilize the runtime" problem.
    • Issue 19: XmlRpcListenerService now sets Content Length header and does not use chunked content by default.

2.2.0

xml-rpc.net.2.2.0.zip

New features and changes:

  • Support for using System.Net.HttpListener to implement an XML-RPC server. (more).
  • Allow client to configure that <string> tag is not used for string values. (more).
  • Server configuration using XmlRpcServiceAttribute. (more).
  • Client support for Accept-Encoding - gzip and deflate. (more).
  • Changes:
    • Fixed null exception if acquiring request stream fails while logging.
    • Fixed stack overflow in GetXmlRpcType if invalid types such as DBNull passed in.
    • Fixed handling of params method parameter if it is first parameter of method.
    • Improved error reporting when processing params parameters.
    • Throw XmlRpcDupXmlRpcMethodNames if same XML-RPC name applied to two methods.
    • Handle zero offset timezones when AllowNonStandardDateTime flag set.

2.1.0

xml-rpc.net.2.1.0.zip

New features and changes:

  • Add support for proxy interfaces with overloaded methods. (more).
  • Add support for the int?, bool?, double?, and DateTime? nullable types to represent struct member types (.NET 2.0 version). These can be used to support optional struct members of int, boolean, double, and dateTime.iso8601 types. (more).

2.0.0

xml-rpc.net.2.0.0.zip

New features and changes:

  • Add generic form of XmlRpcProxyGen.Create() to remove need to cast the result of Create to the relevant interface (v2 assembly only) (more).
  • Add support for XmlRpcNonStandard.AllowInvalidHttpContent to handle HTTP response content which has whitespace before the start of the XML-RPC response (more).
  • Switch from NAnt to MSBuild and now builds a .NET 2.0 assembly as well as a .NET 1.0 assembly. Note that the 1.0 assembly can be used on all versions of the .NET runtime and should be used where backwards compatibility is required. The 2.0 assembly contains enhancements which rely on features of .NET 2.0 such as generics and can only be used on the .NET 2.0 and later versions of the runtime (more).
  • Error handling
    • Throws XmlRpcInvalidParametersException if the parameters array passed to XmlRpcClientProtocol.Invoke contains more parameters than are defined for the method being invoked.
    • Throws XmlRpcInvalidXmlRpcException if a struct member is missing its name or value child element or if it has a duplicate name or value child element.
    • Attempt to serialize type with one or more properties that cannot be serialized to an XML-RPC type now results in the correct exception being thrown: XmlRpcUnsupportedTypeException.
  • Samples:
    • Modify samples to use IXmlRpcProxy interface.
    • Fix threading issue in AsyncBettyApplication sample.

1.0.0

xml-rpc.net.1.0.0.zip

New features and changes:

  • IXmlRpcProxy interface to simplify setting proxy properties (more).
  • Expect100Continue property on XmlRpcClientProtocol to configure “Expect: 100-continue” header; default is header not sent (more).
    • Note: default behavior in previous versions of XML-RPC.NET was to send this header.
  • Support for variable number of method parameters using params (more).
  • Configurable client support for server which don’t comply with XML-RPC standard:
    • UseIntTag proxy property to use <int> instead of <i4>.
    • Support dateTime with all zeroes (e.g. eGroupWare).
    • Support empty dateTime values.
    • Support fault code returned as string.
    • Support for non-standard dateTime formats
    • Note: default is standard XML-RPC only. Existing code which relies on non-standard behaviour will need to configure the proxy NonStandard property (more).
  • Support for sending cookies with request (thanks to JC Bertin) (more).
  • Changes:
    • Fix for when passing zero-length byte array as base64 value.
    • Removed large switch statements to circumvent Microsoft .NET bug when running in version 2.0 of the .NET runtime with medium trust.
    • Uses invariant DateTimeFormatInfo when parsing dateTime.iso8601 so parsing works in all locales
    • Check for recursive data structures when serializing.
    • Fix to allow XmlRpcStruct member to be set more than once.
    • Prevent types which cannot be serialized from being added to XmlRpcStruct.
    • Improved error handling for null values when serializing.
    • Fix to XmlRpcServerFormatterSink suggested by Sean Rohead.
  • Sample code:
    • Updates on sample blogging interfaces from Sam Schillace and Mikahosi.
    • Sample code for accessing OpenDHT (thanks to Michel Foucault).

0.9.2

xml-rpc.net.0.9.2.zip

  • Fixed parsing struct containing an enum member.
  • Lock around generation of proxy type.
  • When generating proxy from interface now includes methods from base interfaces.
  • Added RequestEvent and ResponseEvent events to XmlRpcClientProtocol.
  • Added XmlRpcLogger class for ease of use of RequestEvent and ResponseEvent events.
  • Adding LoggingEample sample.
  • Support for XmlRpcMissingMapping attribute on properties.
  • Invalid struct elements ignored if mapping action is Ignore.
  • Fixed dateTime issue with Wareki calendar.
  • Fixed problem with serializing void return.
  • Modified call to DeserializeResponse in DeserializeMessage.
  • Handles case when server incorrectly returns fault code as a string.
  • XmlRpcStruct restricted to string keys.

0.9.1

xml-rpc.net.0.9.1.zip

  • Distribution includes version of library which runs on .NET Compact Framework.
  • DateTime parsing bug fixed (caused problems in particular with it-IT locale)
  • XmlRpcProxyGen caches generated assemblies to avoid leakage if XmlRpcProxyGen is called multiple times for the same interface.

0.9.0

xml-rpc.net.0.9.0.zip

  • XmlRpcServiceAttribute has a new AutoDocumentation property which allows automatic documentation to be switched off.
  • Handles XML-RPC response encodings other than UTF-8.
  • XmlRpcMemberAttribute fixed.
  • XmlRpcClientProtocol has new ProtocolVersion property to allow HTTP v1.0 to be specified.
  • XmlRpcClientProtocol has new KeepAlive property (default is true). With some servers it may be necessary to set this to false when running with the current beta of the 2.0 CLR, for example if you start seeing the “Underlying Connection Was Closed” exception or the second call on a proxy appears to hang.
  • Multi-dimensional arrays handled correctly.
  • dateTime parsing supports “yyyy-MM-ddTHH:mm:ss” to handle blog service providers which return invalid XML-RPC dateTime values in this format.
  • Includes Joe Bork’s xmlrpcgen utility to generate source code for proxies.
  • Release runs on version 1.0 of CLR upwards.

0.8.0

xml-rpc.net.0.8.0.zip

  • optional struct members

  • The zip file contains a bin directory containing:

  • CookComputing.XmlRpc.dll

  • bettyapp.exe (A WinForms application which calls the UserLand betty example server.)

  • asyncbettyapp.exe (Another WinForms app illustrating how to make async calls.)

  • mathservice.exe (A simple XML-RPC service.)

  • mathapp.exe (A WinForms application which calls MathService.)

0.7.1

xml-rpc.net.0.7.1.zip

  • License change.
  • Fixed problem in XmlRpcServerFormatterSink.cs whereby an exception was thrown if the XML-RPC and .NET method names are different.

0.7.0

xml-rpc.net.0.7.0.zip

  • error reporting of parsing errors using parse stack

  • support for async proxy method generation

  • contiuning work on auto-generated documentation

  • params keywords used in XmlRpcClientProtocol.Invoke

  • server method can return void (return empty string in XML-RPC response)

  • proxy method can return void (return value in XML-RPC response discarded)

  • deserializer throws exception if an XML-RPC struct is missing one or more expected members

  • fixed irritating warning when compiling XmlRpcStruct

  • add version of BeginInvoke taking correct params as per docs

  • Close always called on WebResponse

  • fixed usage of XmlRpcClientProtocol Proxy property when used in VS designer (Drew Marsh)

  • fixed handling of response without Content-Length during async calls (Dmitry Jemerov)

  • fixed case when zero-length string in default string value is passed as <value/> (Drew Marsh)

  • The zip file contains a bin directory containing:

  • CookComputing.XmlRpc.dll

  • bettyapp.exe (A WinForms application which calls the UserLand betty example server.)

  • asyncbettyapp.exe (Another WinForms app illustrating how to make async calls.)

  • mathservice.exe (A simple XML-RPC service.)

  • mathapp.exe (A WinForms application which calls MathService.)

Limitations of Current Release

  • Auto-documentation generation not fully implemented.
  • No tracing/logging functionality.

0.6.0

xml-rpc.net.0.6.0.zip

  • Fixed UserAgent property of XmlRpcClientProtocol.
  • Added Proxy property to XmlRpcClientProtocol.
  • Default for XML-RPC request XML document is no explicit encoding, i.e. implicitly UTF-8.
  • Added Encoding property to XmlRpcClientProtocol to set explicit encoding on XML-RPC request XML document
  • Can now use interface to define XML-RPC methods. For example can use same interface to implement both server and client. MathService changed to illustrate use of interface.
  • Added XmlRpcProxyGen class to dynamically create a proxy object from an interface, i.e. makes hand-coding of proxies unnecessary in most cases. bettyapp sample changed to illustrate this.
  • Fixed parsing of double type to be culture independent.
  • Fault response XML document now generated in same way as ordinary response, i.e. will be in same format and encoding.

0.5.5

xml-rpc.net.0.5.5.zip

  • Added ClientCertificates property to XmlRpcClientProtocol

  • The zip file contains a bin directory containing:

  • CookComputing.XmlRpc.dll

  • bettyapp.exe (A WinForms application which calls the UserLand betty example server.)

  • asyncbettyapp.exe (Another WinForms app illustrating how to make async calls.)

  • mathservice.exe (A simple XML-RPC service.)

  • mathapp.exe (A WinForms application which calls MathService.)

**Limitations of Current Release
**

  • Auto-documentation generation not fully implemented.
  • No tracing/logging functionality.

0.5.4

xml-rpc.net.0.5.4.zip

  • Added Headers property to XmlRpcClientProtocol.
  • Added XmlRpcMemberAttribute.
  • Modified deserialization of arrays to return more specific array type when all elements are of the same type.

0.5.3

xml-rpc.net.0.5.3.zip

  • Fixed problem with deserializing arrays.

0.5.2

xml-rpc.net.0.5.2.zip

  • Improved handling of XmlRpcFaultException in server formatter sink…

0.5.1

xml-rpc.net.0.5.1.zip

  • Improved handling of XmlRpcFaultException in server formatter sink…

0.5.0

xml-rpc.net.0.5.0.zip

  • Interim release containing preliminary code for client and server NET Remoting formatter sinks.
  • A Remoting sample, with assemblies and config files.

0.4.3

xml-rpc.net.0.4.3.zip

  • Interim release containing bug fixes, mainly in the serialization/deserialization code.
  • Some restructuring in preparation for some major changes in the 0.5 series of releases.

0.4.2

xml-rpc.net.0.4.2.zip

  • Build for .NET RTM.
  • Added preliminary support for Introspection API.

0.4.1

xml-rpc.net.0.4.1.zip

  • Major changes to XmlRpcClientProtocol class to support async calls, working but coding not completed.
  • Extra sample - AsyncBettyApp - to illustrate async calls.

0.4.0

Initial release for .NET beta 2.

xml-rpc.net.0.4.0.zip

0.3.0

Initial release for .NET beta 1.

Developers

Lead Developer - Charles Cook.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907