CVE-2024-4690
📋 TL;DR
This vulnerability allows attackers to perform XML External Entity (XXE) attacks through DTD injection in OpenText Application Automation Tools. Attackers can read arbitrary files from the server, potentially leading to sensitive data exposure. All users running affected versions are at risk.
💻 Affected Systems
- OpenText Application Automation Tools
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through file system access, credential theft, and potential remote code execution via XXE.
Likely Case
Unauthorized reading of sensitive files (configuration files, credentials, source code) from the server.
If Mitigated
Limited impact with proper XML parser configuration and network segmentation.
🎯 Exploit Status
XXE vulnerabilities are well-understood attack vectors with readily available exploitation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.1.1 or later
Vendor Advisory: https://portal.microfocus.com/s/article/KM000033548?language=en_US
Restart Required: Yes
Instructions:
1. Download the latest version from OpenText support portal. 2. Backup current installation. 3. Install the update following vendor documentation. 4. Restart the application services.
🔧 Temporary Workarounds
Disable DTD Processing
allConfigure XML parser to disable external entity processing
Set XML parser properties: FEATURE_SECURE_PROCESSING=true, DISALLOW_DOCTYPE_DECL=true
Input Validation
allImplement strict XML schema validation and reject DTD declarations
Implement XML schema validation before processing
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy web application firewall with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check application version in admin console or configuration filesCheck Version:
Check application.properties or admin interface for version informationVerify Fix Applied:
Verify version is 24.1.1 or later and test XXE payloads are rejected📡 Detection & Monitoring
Log Indicators:
- XML parsing errors
- File access attempts via XXE payloads
- Unusual XML input patterns
Network Indicators:
- HTTP requests containing XML with DTD declarations
- Outbound connections initiated by XML parser
SIEM Query:
source="application_logs" AND ("DOCTYPE" OR "ENTITY" OR "SYSTEM") AND NOT expected_xml_pattern