CVE-2025-2777
📋 TL;DR
SysAid On-Prem versions up to 23.3.40 contain an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality. This allows attackers to read arbitrary files from the server and potentially take over administrator accounts. Organizations running vulnerable SysAid On-Prem installations are affected.
💻 Affected Systems
- SysAid On-Prem
📦 What is this software?
Sysaid by Sysaid
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including administrator account takeover, sensitive file exfiltration, and potential lateral movement within the network.
Likely Case
Unauthenticated attackers reading sensitive files (configuration files, credentials) and potentially escalating to administrator access.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external exploitation attempts.
🎯 Exploit Status
Public exploit code and detailed analysis available from watchtowr labs. Attack requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.4.0 or later
Vendor Advisory: https://documentation.sysaid.com/docs/24-40-60
Restart Required: Yes
Instructions:
1. Backup your SysAid instance. 2. Download and install SysAid version 24.4.0 or later from the official vendor portal. 3. Restart the SysAid service. 4. Verify the installation completed successfully.
🔧 Temporary Workarounds
Disable XML External Entity Processing
allConfigure XML parsers to disable external entity processing
Configure XML parser settings to set: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
Network Access Restriction
allRestrict access to SysAid web interface to trusted networks only
Configure firewall rules to limit access to SysAid ports (typically 8080, 8443) to internal IP ranges only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SysAid servers from internet and untrusted networks
- Deploy web application firewall (WAF) with XXE protection rules and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check SysAid version via web interface admin panel or by examining installation directory version filesCheck Version:
Check web interface at /help/about.jsp or examine /SysAidServer/version.txt fileVerify Fix Applied:
Verify version is 24.4.0 or later and test XXE payloads no longer work📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Multiple failed authentication attempts from single IP
- Requests containing XML entities like <!DOCTYPE or <!ENTITY
Network Indicators:
- HTTP POST requests to /lshw endpoint with XML content
- Outbound connections to external servers from SysAid host
SIEM Query:
source="sysaid" AND (uri="/lshw" OR message="XML" OR message="DOCTYPE")