CVE-2022-38840
📋 TL;DR
CVE-2022-38840 is an XML External Entity (XXE) vulnerability in the xmlstatus.cgi component of Güralp MAN-EAM-0003 seismic monitoring systems. It allows attackers to upload malicious XML files that can read local files on the system. Organizations using Güralp MAN-EAM-0003 version 3.2.4 are affected.
💻 Affected Systems
- Güralp MAN-EAM-0003
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through local file disclosure of sensitive files like configuration files, credentials, or SSH keys, potentially leading to lateral movement within the network.
Likely Case
Disclosure of sensitive local files including configuration data, system information, and potentially authentication credentials stored on the device.
If Mitigated
Limited impact if proper network segmentation and file upload restrictions are in place, preventing access to critical system files.
🎯 Exploit Status
Exploitation requires XML file upload capability to the vulnerable endpoint. Public proof-of-concept demonstrates file disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Contact Güralp support for patching guidance. No official patch information is publicly documented.
🔧 Temporary Workarounds
Disable XML External Entity Processing
linuxConfigure the XML parser to disable external entity resolution
Modify xmlstatus.cgi to set XML parser features: FEATURE_SECURE_PROCESSING=true, DISABLE_DTD=true
Restrict File Uploads
allImplement strict file upload validation and filtering
Add input validation to reject XML files with DOCTYPE declarations or external entity references
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the device from sensitive systems
- Deploy a web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Test by uploading an XML file with external entity reference to /cgi-bin/xmlstatus.cgi and checking if local file content is returnedCheck Version:
Check device web interface or contact Güralp support for version informationVerify Fix Applied:
Attempt the same XXE test after applying workarounds to confirm file disclosure is prevented📡 Detection & Monitoring
Log Indicators:
- Unusual XML file uploads to xmlstatus.cgi
- Multiple failed file upload attempts
- Access to sensitive local file paths in web logs
Network Indicators:
- HTTP POST requests to /cgi-bin/xmlstatus.cgi with XML content
- Unusual outbound file transfers from the device
SIEM Query:
source="web_logs" AND uri="/cgi-bin/xmlstatus.cgi" AND method="POST" AND content_type="text/xml"🔗 References
- http://packetstormsecurity.com/files/171439/MAN-EAM-0003-3.2.4-XML-Injection.html
- https://drive.google.com/drive/folders/1UG5IcL8fFp9MV0vjd78_cx6iXKda5bpM?usp=sharing
- http://packetstormsecurity.com/files/171439/MAN-EAM-0003-3.2.4-XML-Injection.html
- https://drive.google.com/drive/folders/1UG5IcL8fFp9MV0vjd78_cx6iXKda5bpM?usp=sharing
