CVE-2020-35604
📋 TL;DR
CVE-2020-35604 is an XML External Entity (XXE) vulnerability in Kronos WebTA 5.0.4 when SAML authentication is configured. This allows attackers to read arbitrary files from the server, potentially leading to sensitive data exposure. Organizations using WebTA 5.0.4 with SAML are affected.
💻 Affected Systems
- Kronos WebTA
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via file disclosure leading to credential theft, lateral movement, and potential ransomware deployment.
Likely Case
Unauthorized access to sensitive server files including configuration files, credentials, and user data.
If Mitigated
Limited impact if proper network segmentation and file system permissions are in place.
🎯 Exploit Status
XXE vulnerabilities are well-understood with readily available exploitation tools. The SAML authentication requirement adds a minor complexity barrier.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.5 or later
Vendor Advisory: https://www.kronos.com/products/kronos-webta
Restart Required: Yes
Instructions:
1. Download WebTA 5.0.5 or later from Kronos support portal. 2. Backup current configuration and database. 3. Run the installer to upgrade. 4. Restart the WebTA service and IIS. 5. Verify SAML functionality.
🔧 Temporary Workarounds
Disable SAML Authentication
windowsTemporarily switch to basic authentication until patching is possible.
Modify WebTA web.config to remove SAML settings and enable basic auth
XML Parser Hardening
allConfigure XML parser to disable external entity processing.
Set XmlResolver property to null in XML parsing code
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WebTA server from sensitive systems
- Deploy web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running WebTA 5.0.4 with SAML enabled in authentication settings.Check Version:
Check WebTA administration panel or examine web.config version tagVerify Fix Applied:
Verify WebTA version is 5.0.5 or later and test SAML authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors in IIS logs
- Multiple failed SAML authentication attempts
Network Indicators:
- XML payloads with external entity references in HTTP requests
- Unusual outbound connections from WebTA server
SIEM Query:
source="IIS" AND (message="*XXE*" OR message="*external entity*" OR message="*DOCTYPE*")