CVE-2020-25911
📋 TL;DR
This XXE vulnerability in MODX CMS 2.7.3 allows attackers to read arbitrary files from the server or cause denial of service by sending specially crafted XML requests to the modRestServiceRequest component. It affects all MODX CMS installations running version 2.7.3 with the vulnerable component enabled. Attackers can exploit this without authentication if the REST service is publicly accessible.
💻 Affected Systems
- MODX CMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through sensitive file disclosure (e.g., /etc/passwd, configuration files, database credentials), leading to data theft and potential lateral movement within the network.
Likely Case
Information disclosure of sensitive server files and potential denial of service through resource exhaustion via entity expansion attacks.
If Mitigated
Minimal impact if XML external entity processing is disabled or proper input validation/filtering is implemented.
🎯 Exploit Status
Public proof-of-concept demonstrates file disclosure. Exploitation requires sending malicious XML to the REST endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.4 and later
Vendor Advisory: https://github.com/modxcms/revolution/issues/15237
Restart Required: No
Instructions:
1. Update MODX CMS to version 2.7.4 or later. 2. Apply the patch from the vendor advisory. 3. Verify the fix by testing XXE payloads against the REST endpoint.
🔧 Temporary Workarounds
Disable XML External Entity Processing
allConfigure the XML parser to disable external entity resolution
Set libxml_disable_entity_loader(true) in PHP configuration
Configure XML parser with FEATURE_SECURE_PROCESSING
Restrict REST Service Access
allLimit access to modRestServiceRequest endpoints
Use .htaccess to restrict IP access
Implement authentication for REST endpoints
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with XXE protection rules
- Disable the modRestServiceRequest component entirely if not needed
🔍 How to Verify
Check if Vulnerable:
Send a test XXE payload to the REST endpoint (e.g., POST with XML containing <!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]><test>&xxe;</test>) and check if file contents are returned.Check Version:
Check MODX version in manager dashboard or examine core/config/config.inc.phpVerify Fix Applied:
Attempt the same XXE payload after patching; it should return an error or empty response instead of file contents.📡 Detection & Monitoring
Log Indicators:
- Unusual XML requests to REST endpoints
- Large XML payloads with DOCTYPE declarations
- Requests for known sensitive files in XML parameters
Network Indicators:
- XML requests containing SYSTEM entities
- HTTP requests with unusual file paths in XML bodies
SIEM Query:
source="web_logs" AND (uri="*rest*" OR uri="*api*") AND (body="*<!DOCTYPE*" OR body="*<!ENTITY*")