CVE-2019-3752
📋 TL;DR
This XXE vulnerability in Dell EMC Avamar Server and IDPA allows remote unauthenticated attackers to cause denial of service or information disclosure by sending specially crafted XML requests. Affected systems include Avamar Server versions 7.4.1 through 19.1 and IDPA versions 2.0 through 2.4.
💻 Affected Systems
- Dell EMC Avamar Server
- Dell EMC Integrated Data Protection Appliance (IDPA)
📦 What is this software?
Emc Integrated Data Protection Appliance by Dell
View all CVEs affecting Emc Integrated Data Protection Appliance →
Emc Integrated Data Protection Appliance by Dell
View all CVEs affecting Emc Integrated Data Protection Appliance →
Emc Integrated Data Protection Appliance by Dell
View all CVEs affecting Emc Integrated Data Protection Appliance →
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker could read arbitrary files from the server, potentially including sensitive configuration files or credentials, leading to full system compromise.
Likely Case
Denial of service through resource exhaustion or limited information disclosure from accessible files.
If Mitigated
No impact if systems are patched or properly firewalled from untrusted networks.
🎯 Exploit Status
Exploitation requires sending specially crafted XML to vulnerable endpoints. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Avamar Server 19.2 and later; IDPA 2.5 and later
Vendor Advisory: https://www.dell.com/support/security/en-us/details/537853/DSA-2019-119-Dell-EMC-Avamar-XML-External-Entity-Injection-Vulnerability
Restart Required: Yes
Instructions:
1. Download latest patches from Dell support portal. 2. Apply patches according to Dell documentation. 3. Restart affected services. 4. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Avamar/IDPA management interfaces to trusted IPs only
XML Input Validation
allImplement XML schema validation and disable external entity processing in XML parsers
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor for unusual XML traffic patterns and file access attempts
🔍 How to Verify
Check if Vulnerable:
Check Avamar/IDPA version against affected versions list. If running affected version and exposed to network, assume vulnerable.Check Version:
Check via Avamar/IDPA web interface or administrative consoleVerify Fix Applied:
Verify version is Avamar Server 19.2+ or IDPA 2.5+. Test with controlled XXE payload if possible.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Multiple failed XML requests
- File access attempts via XML parsing
Network Indicators:
- XML requests with DTD declarations
- External entity references in XML
SIEM Query:
source="avamar" AND (xml OR dtd OR xxe) AND (error OR fail OR exception)