CVE-2020-10992
📋 TL;DR
CVE-2020-10992 is an XML External Entity (XXE) vulnerability in Azkaban workflow scheduler that allows attackers to read arbitrary files from the server filesystem. This affects all Azkaban installations through version 3.84.0 that process XML configuration files. Attackers can potentially access sensitive data including configuration files, credentials, and system files.
💻 Affected Systems
- Azkaban
📦 What is this software?
Azkaban by Azkaban Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file disclosure leading to credential theft, lateral movement, and potential remote code execution via disclosed sensitive files.
Likely Case
Unauthorized access to sensitive configuration files, database credentials, SSH keys, and other system files stored on the Azkaban server.
If Mitigated
Limited impact if XML parsing is disabled or external entity processing is blocked at the network/application level.
🎯 Exploit Status
XXE vulnerabilities are well-understood with readily available exploitation tools. The vulnerability requires XML file processing but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.85.0 and later
Vendor Advisory: https://github.com/azkaban/azkaban/issues/2478
Restart Required: Yes
Instructions:
1. Upgrade Azkaban to version 3.85.0 or later. 2. Replace vulnerable XmlValidatorManager.java and XmlUserManager.java files. 3. Restart Azkaban services. 4. Verify XML parsing now disallows external entities.
🔧 Temporary Workarounds
Disable External Entity Processing
allConfigure XML parsers to disallow external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
Input Validation Filter
allImplement input filtering to block XML files containing external entity declarations
Add regex filter: /<!ENTITY\s+.*SYSTEM\s+.*>/i
🧯 If You Can't Patch
- Implement network segmentation to isolate Azkaban instances from sensitive systems
- Deploy web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check Azkaban version: grep -r 'azkaban.version' /path/to/azkaban/conf/azkaban.propertiesCheck Version:
cat /path/to/azkaban/conf/azkaban.properties | grep azkaban.versionVerify Fix Applied:
Test XML file upload with external entity declaration; should be rejected or processed without entity resolution📡 Detection & Monitoring
Log Indicators:
- XML parsing errors mentioning external entities
- Unusual file access patterns from Azkaban processes
- Large XML file uploads to configuration endpoints
Network Indicators:
- HTTP requests with XML payloads containing ENTITY declarations
- Outbound connections from Azkaban to unexpected external systems
SIEM Query:
source="azkaban.log" AND ("ENTITY" OR "SYSTEM" OR "DOCTYPE")