CVE-2023-42344 Scanner

Targets XML parsing endpoints in OpenCMS versions before 10.5.1, allowing attackers to read server files or perform SSRF.

Short Info


Level

High

Single Scan

Single Scan

Can be used by

Asset Owner

Estimated Time

10 seconds

Time Interval

1 month 9 days

Scan only one

URL

Toolbox

OpenCMS is a professional, open-source content management system widely used by enterprises and organizations to manage and publish web content. It provides a robust platform for creating, editing, and managing websites, with features like workflow management, template engines, and multi-language support. System administrators and developers rely on OpenCMS for its flexibility and scalability in handling complex content structures.

XML External Entity (XXE) vulnerability in OpenCMS arises when the application processes XML input from untrusted sources without proper validation. This flaw occurs because the XML parser is configured to resolve external entities, allowing attackers to inject malicious XML content. The vulnerability is rooted in the failure to disable external entity processing in the underlying XML library, making it a classic XXE issue.

Specifically, the vulnerability affects the XML parsing functionality in OpenCMS versions prior to 10.5.1. Attackers can exploit this by sending crafted XML payloads to endpoints that handle XML data, such as import or export functions. The vulnerable parameter is typically the XML body itself, where external entities can be defined and referenced to access local files or internal resources.

If exploited, this XXE vulnerability can lead to severe consequences, including unauthorized access to sensitive files like configuration files or user data, server-side request forgery (SSRF) enabling attacks on internal systems, and potential denial of service. The CVSS score of 8.2 highlights the high risk, as attackers can compromise the confidentiality and integrity of the OpenCMS server and its data.

Get started to protecting your digital assets