CVE-2019-14277
📋 TL;DR
CVE-2019-14277 is an unauthenticated XML injection vulnerability in Axway SecureTransport's resetPassword REST API functionality. It allows attackers to perform XXE attacks leading to local file disclosure, denial of service, or SSRF attacks that could result in remote code execution. Affected systems include Axway SecureTransport versions 5.x through 5.3 (or 5.x through 5.5 with certain API configurations).
💻 Affected Systems
- Axway SecureTransport
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution via SSRF leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Local file disclosure of sensitive system files, configuration files, or credentials stored on the server.
If Mitigated
Denial of service through XML parsing resource exhaustion or limited information disclosure.
🎯 Exploit Status
Multiple public exploit scripts available, including on Exploit-DB and GitHub. The vulnerability requires no authentication and has simple XML payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SecureTransport 5.3.9 and later, or 5.5.2 and later
Vendor Advisory: https://community.axway.com/s/article/SecureTransport-Security-Notice-re-CVE-2019-14277-Unauthenticated-XML-Injection-and-XXE
Restart Required: Yes
Instructions:
1. Download the latest SecureTransport patch from Axway support portal. 2. Apply the patch according to Axway documentation. 3. Restart SecureTransport services. 4. Verify the fix by testing the resetPassword endpoint.
🔧 Temporary Workarounds
Disable resetPassword REST API endpoint
allTemporarily disable the vulnerable resetPassword functionality in the REST API configuration
Modify SecureTransport configuration to remove or disable resetPassword endpoint access
Network segmentation and access control
linuxRestrict access to SecureTransport REST API endpoints using firewall rules
iptables -A INPUT -p tcp --dport [SecureTransport_PORT] -s [TRUSTED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [SecureTransport_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SecureTransport instances from sensitive systems
- Deploy web application firewall (WAF) with XXE protection rules to block malicious XML payloads
🔍 How to Verify
Check if Vulnerable:
Test the resetPassword REST API endpoint with a simple XXE payload to see if it returns system files or causes parsing errors.Check Version:
Check SecureTransport version via admin interface or configuration filesVerify Fix Applied:
Attempt the same XXE payload after patching; it should be rejected or return an error without disclosing information.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in SecureTransport logs
- Multiple failed resetPassword attempts with XML payloads
- Requests to internal file paths from resetPassword endpoint
Network Indicators:
- HTTP POST requests to /api/v1.0/users/resetPassword with XML content
- Outbound connections from SecureTransport server to unexpected internal systems
SIEM Query:
source="securetransport" AND (uri_path="/api/v1.0/users/resetPassword" AND (content="<!ENTITY" OR content="SYSTEM" OR content="file://"))🔗 References
- https://community.axway.com/s/article/SecureTransport-Security-Notice
- https://community.axway.com/s/article/SecureTransport-Security-Notice-re-CVE-2019-14277-Unauthenticated-XML-Injection-and-XXE
- https://gist.githubusercontent.com/zeropwn/59f17727dfaba239b0ace6f33b752974/raw/9b6541a94ac5ec181a88e6c84cb3e3001025b8fd/Axway%2520SecureTransport%25205.x%2520Unauthenticated%2520XXE
- https://www.exploit-db.com/exploits/47150
- https://zero.lol/2019-07-21-axway-securetransport-xml-injection/
- https://community.axway.com/s/article/SecureTransport-Security-Notice
- https://community.axway.com/s/article/SecureTransport-Security-Notice-re-CVE-2019-14277-Unauthenticated-XML-Injection-and-XXE
- https://gist.githubusercontent.com/zeropwn/59f17727dfaba239b0ace6f33b752974/raw/9b6541a94ac5ec181a88e6c84cb3e3001025b8fd/Axway%2520SecureTransport%25205.x%2520Unauthenticated%2520XXE
- https://www.exploit-db.com/exploits/47150
- https://zero.lol/2019-07-21-axway-securetransport-xml-injection/
