Cve-2024-2374 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2024-2374/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 16 Apr 2024 09:16:34 +0000WSO2 Products Vulnerable to XML External Entity (XXE) Injection via CVE-2024-2374https://feed.craftedsignal.io/briefs/2024-04-wso2-xxe/Tue, 16 Apr 2024 09:16:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-04-wso2-xxe/CVE-2024-2374 describes an XML External Entity (XXE) vulnerability in multiple WSO2 products, where improperly configured XML parsers allow attackers to inject malicious XML payloads to include external resources, leading to confidential file access, limited HTTP resource access, and denial-of-service attacks.CVE-2024-2374 exposes a critical vulnerability in multiple WSO2 products stemming from improper configuration of XML parsers. These parsers, when processing user-supplied XML data, fail to prevent the resolution of external entities. This oversight enables attackers to inject malicious XML payloads designed to include external resources, both local and remote. The vulnerability allows an attacker to read confidential files from the file system, access limited HTTP resources reachable by the product, and perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources. This poses a significant risk to the confidentiality, integrity, and availability of WSO2-based systems.

Attack Chain

  1. The attacker identifies a WSO2 product exposed to network traffic.
  2. The attacker crafts a malicious XML payload containing an external entity declaration (e.g., <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>).
  3. The attacker submits the malicious XML payload to a WSO2 endpoint that processes XML data, such as an API endpoint or configuration upload page, via an HTTP POST request.
  4. The WSO2 product's XML parser processes the payload without proper configuration to disable external entity resolution.
  5. The parser attempts to resolve the external entity, initiating a read operation on the specified file (/etc/passwd in the example) or a request to a remote HTTP resource.
  6. The contents of the file or the response from the HTTP resource are embedded into the XML document, potentially visible in error messages or other outputs.
  7. The attacker retrieves sensitive information, such as system files, configuration data, or credentials.
  8. Alternatively, the attacker crafts a payload with deeply nested or recursive external entities, causing the XML parser to consume excessive CPU and memory, resulting in a denial-of-service condition.

Impact

Successful exploitation of CVE-2024-2374 can lead to the exposure of sensitive data residing on the WSO2 server's file system, including configuration files, credentials, and internal application data. An attacker can also access internal HTTP resources that the WSO2 server has access to. Furthermore, the vulnerability can be leveraged to trigger denial-of-service conditions, disrupting WSO2 services and impacting business operations. While specific numbers are unavailable, a widespread exploitation could affect numerous organizations relying on vulnerable WSO2 products across various sectors.

Recommendation

  • Apply the security patches or updates provided by WSO2 to address CVE-2024-2374 on all affected products immediately.
  • Deploy the Sigma rule Detect XXE Attempt via HTTP Request to identify potential exploitation attempts targeting WSO2 servers (or other systems).
  • Monitor web server logs for suspicious POST requests containing XML content with external entity declarations, focusing on the cs-uri-query and cs-uri-path fields (webserver log source).
  • Implement input validation and sanitization measures on all XML data processed by WSO2 products to prevent the injection of malicious payloads.
]]>highadvisoryxxecve-2024-2374wso2xmlvulnerabilityattackcloudnetwork