CVE-2022-26662
📋 TL;DR
This CVE describes an XML Entity Expansion (XEE) vulnerability in Tryton Application Platform that allows unauthenticated attackers to send crafted XML-RPC messages to consume all server resources. This affects Tryton Server versions 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x/6.2.x through 6.2.5, and Tryton Command Line Client (proteus) versions 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x/6.2.x through 6.2.1.
💻 Affected Systems
- Tryton Application Platform (Server)
- Tryton Command Line Client (proteus)
📦 What is this software?
Proteus by Tryton
Proteus by Tryton
Proteus by Tryton
Trytond by Tryton
Trytond by Tryton
Trytond by Tryton
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through resource exhaustion, potentially causing server crashes and extended downtime.
Likely Case
Service disruption and performance degradation affecting all users of the Tryton application.
If Mitigated
Limited impact if XML-RPC interface is disabled or properly firewalled.
🎯 Exploit Status
Exploitation requires sending crafted XML-RPC messages, which is straightforward for attackers familiar with XEE techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Server: 5.0.46, 6.0.16, 6.2.6; Client: 5.0.12, 6.0.5, 6.2.2
Vendor Advisory: https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
Restart Required: Yes
Instructions:
1. Backup your Tryton configuration and data. 2. Update Tryton Server to version 5.0.46, 6.0.16, or 6.2.6. 3. Update Tryton Command Line Client to version 5.0.12, 6.0.5, or 6.2.2. 4. Restart all Tryton services. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable XML-RPC Interface
allDisable XML-RPC functionality if not required for your deployment.
Edit Tryton configuration to disable XML-RPC or block XML-RPC port (typically 8000)
Network Access Control
linuxRestrict access to XML-RPC port using firewall rules.
iptables -A INPUT -p tcp --dport 8000 -j DROP
ufw deny 8000
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Tryton servers from untrusted networks.
- Deploy rate limiting and XML validation at network perimeter to block malicious XML-RPC requests.
🔍 How to Verify
Check if Vulnerable:
Check Tryton version using 'trytond --version' or 'proteus --version' and compare against affected versions.Check Version:
trytond --versionVerify Fix Applied:
Verify version is updated to patched versions: Server 5.0.46+, 6.0.16+, or 6.2.6+; Client 5.0.12+, 6.0.5+, or 6.2.2+.📡 Detection & Monitoring
Log Indicators:
- Unusually large XML-RPC requests
- Memory exhaustion warnings
- Process termination due to resource limits
Network Indicators:
- Multiple XML-RPC requests with nested entity declarations
- Traffic spikes to XML-RPC port
SIEM Query:
source="tryton.log" AND ("XML-RPC" OR "memory" OR "resource") AND ("error" OR "warning" OR "exhausted")🔗 References
- https://bugs.tryton.org/issue11244
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
- https://www.debian.org/security/2022/dsa-5098
- https://www.debian.org/security/2022/dsa-5099
- https://bugs.tryton.org/issue11244
- https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
- https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
- https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
- https://www.debian.org/security/2022/dsa-5098
- https://www.debian.org/security/2022/dsa-5099
