CVE-2023-24323
📋 TL;DR
Mojoportal v2.7 contains an authenticated XML external entity (XXE) injection vulnerability that allows authenticated attackers to read arbitrary files from the server or potentially perform server-side request forgery. This affects all installations of Mojoportal version 2.7 that have not been patched.
💻 Affected Systems
- Mojoportal
📦 What is this software?
Mojoportal by Mojoportal
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file disclosure of sensitive configuration files, credentials, or SSRF leading to internal network reconnaissance and attacks.
Likely Case
Unauthorized file reading of server files containing sensitive information like configuration files, passwords, or source code.
If Mitigated
Limited impact if proper network segmentation, file permissions, and XML parser hardening are implemented.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.7.0.1 or later
Vendor Advisory: https://www.mojoportal.com/
Restart Required: Yes
Instructions:
1. Backup your current installation. 2. Download the latest version from the official repository. 3. Replace vulnerable files with patched versions. 4. Restart the application server.
🔧 Temporary Workarounds
Disable XML external entity processing
allConfigure the XML parser to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
Restrict authenticated user access
allLimit user accounts to only trusted personnel and implement strong authentication controls
🧯 If You Can't Patch
- Implement network segmentation to isolate Mojoportal from sensitive internal systems
- Deploy a web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running Mojoportal version 2.7.0.0 or earlier by examining version files or admin panelCheck Version:
Check /version.txt file or admin panel system infoVerify Fix Applied:
Verify installation shows version 2.7.0.1 or later in admin panel or version files📡 Detection & Monitoring
Log Indicators:
- Unusual XML file uploads or processing
- Multiple file read attempts from authenticated users
- XML parsing errors containing file paths
Network Indicators:
- XML payloads containing external entity references in POST requests
- Outbound connections to internal resources from web server
SIEM Query:
source="web_logs" AND (uri_path="*/xml*" OR method="POST") AND (message="*DOCTYPE*" OR message="*ENTITY*" OR message="*file:*")