CVE-2018-18406
📋 TL;DR
This is a blind XML External Entity (XXE) vulnerability in Tufin SecureTrack's Audit Report module that allows attackers to read restricted operating system files by injecting malicious XML payloads when saving Best Practices Reports. The vulnerability affects all user types (administrators and normal users) and returns stolen file contents in the report's name field. With a CVSS score of 9.9, this represents a critical information disclosure risk.
💻 Affected Systems
- Tufin SecureTrack
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive system files including configuration files, password files, SSH keys, and other credentials, potentially leading to complete system compromise and lateral movement within the network.
Likely Case
Attackers will exfiltrate sensitive configuration files, user credentials, and system information that can be used for further attacks or privilege escalation.
If Mitigated
With proper network segmentation and access controls, the impact is limited to the Tufin SecureTrack system itself, though sensitive data from that system could still be compromised.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB (ID: 45808). Attack requires valid user credentials but works for both admin and normal users. The XXE is blind but returns data in the report name field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Tufin support for specific patched versions
Vendor Advisory: https://forum.tufin.com/support/kc/latest/
Restart Required: Yes
Instructions:
1. Contact Tufin support for the latest security patches. 2. Apply the patch according to Tufin's documentation. 3. Restart the Tufin SecureTrack services. 4. Verify the fix by testing the vulnerability.
🔧 Temporary Workarounds
Disable XXE Processing
allConfigure XML parsers to disable external entity processing
Configure XML parser settings to: FEATURE_SECURE_PROCESSING = true
Set: http://apache.org/xml/features/disallow-doctype-decl = true
Set: http://xml.org/sax/features/external-general-entities = false
Set: http://xml.org/sax/features/external-parameter-entities = false
Input Validation
allImplement strict input validation for XML input fields
Implement XML schema validation
Use whitelisting for allowed XML elements
Sanitize user input before XML processing
🧯 If You Can't Patch
- Implement network segmentation to isolate Tufin SecureTrack from sensitive systems
- Restrict user access to only necessary personnel and implement principle of least privilege
🔍 How to Verify
Check if Vulnerable:
Test by creating a Best Practices Report with a malicious XXE payload in the XML input field and checking if file contents appear in the report name field.Check Version:
Check Tufin SecureTrack version via web interface or command line: tufin --version or via web admin consoleVerify Fix Applied:
Attempt the same XXE payload after patching - it should fail to return file contents and should reject or sanitize the malicious XML.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Multiple failed report generation attempts
- Reports with suspicious names containing file paths or system data
- Large XML payloads in audit logs
Network Indicators:
- Unusual outbound connections from Tufin server following report generation
- HTTP requests with XML payloads containing file:// or other external entity references
SIEM Query:
source="tufin_securetrack" AND (event_type="report_generation" AND (message="*file://*" OR message="*ENTITY*" OR message="*SYSTEM*")) OR (report_name CONTAINS "/etc/" OR report_name CONTAINS "/root/")