CVE-2023-22274
📋 TL;DR
An unauthenticated attacker can exploit this XXE vulnerability in Adobe RoboHelp Server to read sensitive files from the server filesystem. This affects all RoboHelp Server versions 11.4 and earlier without requiring any user interaction.
💻 Affected Systems
- Adobe RoboHelp Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server filesystem disclosure including configuration files, credentials, and sensitive data
Likely Case
Partial information disclosure of accessible files, potentially revealing system information or configuration details
If Mitigated
No impact if proper XML parsing restrictions are implemented or server is patched
🎯 Exploit Status
XXE vulnerabilities typically have low exploitation complexity and this requires no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.5 or later
Vendor Advisory: https://helpx.adobe.com/security/products/robohelp-server/apsb23-53.html
Restart Required: Yes
Instructions:
1. Download RoboHelp Server 11.5 or later from Adobe. 2. Install the update following Adobe's installation guide. 3. Restart the RoboHelp Server service.
🔧 Temporary Workarounds
Disable external entity processing
allConfigure XML parser to disable external entity resolution
Configure XML parser settings: set javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING to true
Disable DTD processing in XML parsers
Network segmentation
allRestrict access to RoboHelp Server to trusted networks only
Configure firewall rules to limit inbound connections
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy web application firewall with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check RoboHelp Server version in administration interface or installation directoryCheck Version:
Check version.txt in installation directory or via admin interfaceVerify Fix Applied:
Verify version is 11.5 or later and test XXE payloads are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Multiple failed XML parsing attempts
- Requests with XML content containing external entity references
Network Indicators:
- HTTP requests with XML payloads containing SYSTEM or PUBLIC DTD declarations
- Outbound connections to unusual domains from server process
SIEM Query:
source="robohelp.log" AND ("XML parsing error" OR "DOCTYPE" OR "SYSTEM")