CVE-2021-38555
📋 TL;DR
This XXE vulnerability in Any23 allows attackers to read arbitrary files from the server filesystem and potentially access internal systems. It affects Any23 versions before 2.5 when processing untrusted XML input. Organizations using vulnerable Any23 versions for XML parsing are at risk.
💻 Affected Systems
- Apache Any23
📦 What is this software?
Any23 by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise including sensitive file disclosure, internal network reconnaissance, and potential remote code execution via XXE-based attacks.
Likely Case
Unauthorized file system access leading to credential theft, configuration exposure, and potential data exfiltration.
If Mitigated
Limited impact with proper XML parser configuration and input validation, potentially only causing denial of service.
🎯 Exploit Status
XXE exploitation is well-documented with many public tools available. Attack requires XML input processing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5
Vendor Advisory: https://lists.apache.org/thread.html/r589d1a9f94dbeee7a0f5dbe8513a0e300dfe669bd964ba2fbfe28e07%40%3Cannounce.apache.org%3E
Restart Required: Yes
Instructions:
1. Download Any23 version 2.5 or later from Apache. 2. Replace existing Any23 installation. 3. Restart any services using Any23. 4. Verify XML processing functionality.
🔧 Temporary Workarounds
Disable XXE in XML parser
allConfigure XML parser to disable external entity processing
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, disallow-doctype-decl=true
Input validation and sanitization
allValidate and sanitize XML input before processing
Implement XML schema validation
Use whitelist for allowed XML elements
🧯 If You Can't Patch
- Implement network segmentation to isolate Any23 instances from sensitive systems
- Deploy web application firewall with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check Any23 version: java -jar any23-cli.jar --version or examine pom.xml for version < 2.5Check Version:
java -jar any23-cli.jar --versionVerify Fix Applied:
Confirm version is 2.5 or higher and test XML processing with XXE payloads📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Large XML payloads with external entity references
- Failed XML parsing attempts
Network Indicators:
- HTTP requests with XML containing SYSTEM or PUBLIC declarations
- Outbound connections to unexpected internal IPs from Any23 process
SIEM Query:
source="any23.log" AND ("SYSTEM" OR "PUBLIC" OR "ENTITY")