CVE-2023-22377
📋 TL;DR
This XXE vulnerability in tsClinical software allows attackers to read arbitrary files on the system by processing specially crafted XML files. It affects all users of tsClinical Define.xml Generator versions 1.0.0-1.4.0 and tsClinical Metadata Desktop Tools versions 1.0.3-1.1.0 who process untrusted XML input.
💻 Affected Systems
- tsClinical Define.xml Generator
- tsClinical Metadata Desktop Tools
📦 What is this software?
Tsclinical Define.xml Generator by Fujitsu
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through sensitive file disclosure (passwords, configuration files, SSH keys) leading to lateral movement or data exfiltration.
Likely Case
Unauthorized reading of sensitive files containing application data, credentials, or system information.
If Mitigated
Limited impact with proper XML parsing configuration and input validation in place.
🎯 Exploit Status
Exploitation requires ability to submit XML files to the application; no authentication bypass needed beyond file upload access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Define.xml Generator: v1.4.1 or later; Metadata Desktop Tools: v1.1.1 or later
Vendor Advisory: https://github.com/tsClinical/tsc-desktop/security/advisories
Restart Required: Yes
Instructions:
1. Download latest version from official source. 2. Backup configuration and data. 3. Uninstall old version. 4. Install patched version. 5. Restart system/services.
🔧 Temporary Workarounds
Disable XXE in XML parser
allConfigure XML parser to disable external entity processing
Set FEATURE_SECURE_PROCESSING = true
Set XMLConstants.FEATURE_SECURE_PROCESSING = true
Disable DTD processing
Input validation and sanitization
allImplement strict validation of XML input before processing
Validate XML against schema
Reject XML with DOCTYPE declarations
Use whitelist for allowed XML elements
🧯 If You Can't Patch
- Restrict XML file uploads to trusted sources only
- Implement network segmentation to isolate vulnerable systems from sensitive data
🔍 How to Verify
Check if Vulnerable:
Check application version against affected ranges; test with XXE payload in XML file upload.Check Version:
Check application About menu or configuration files for version informationVerify Fix Applied:
Verify version is patched (v1.4.1+ for Define.xml Generator, v1.1.1+ for Metadata Tools); test with XXE payload that should be rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- XML parsing errors with external entity references
- Large XML file uploads
Network Indicators:
- XML file uploads containing DOCTYPE declarations
- Outbound connections to unusual ports during XML processing
SIEM Query:
source="application_logs" AND ("DOCTYPE" OR "ENTITY" OR "SYSTEM") AND NOT "expected_xml_pattern"