CVE-2025-35112
📋 TL;DR
Agiloft Release 28 contains an XML External Entities (XXE) vulnerability in import/export functionality that allows authenticated attackers to perform path traversal and read local system files. This affects all Agiloft installations running Release 28 with import/export enabled on any table. Only authenticated users can exploit this vulnerability.
💻 Affected Systems
- Agiloft
📦 What is this software?
Agiloft by Atlassian
⚠️ Risk & Real-World Impact
Worst Case
An authenticated malicious insider could read sensitive system files, configuration files, or potentially access credentials stored on the server filesystem.
Likely Case
Authenticated users with import/export permissions could read arbitrary files from the server filesystem, potentially exposing configuration data or other sensitive information.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized users who already have access to sensitive data.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the import/export functionality. Attackers need to craft malicious XML files with external entity references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Agiloft Release 31
Vendor Advisory: https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution
Restart Required: No
Instructions:
1. Backup your Agiloft instance. 2. Upgrade to Agiloft Release 31 following vendor upgrade procedures. 3. Verify the upgrade completed successfully. 4. Test import/export functionality.
🔧 Temporary Workarounds
Disable Import/Export Functionality
allTemporarily disable import/export functionality on all tables until patching can be completed.
Navigate to Table Settings > Permissions > Disable 'Import/Export' for all user roles
Restrict XML Processing
allConfigure XML parser to disable external entity processing if possible in your environment.
🧯 If You Can't Patch
- Implement strict access controls to limit import/export permissions to only essential users
- Monitor import/export activity logs for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check Agiloft version in admin interface. If version is Release 28, the system is vulnerable.Check Version:
Check Agiloft admin dashboard or use vendor-specific version check command for your installation.Verify Fix Applied:
After upgrading to Release 31, verify version in admin interface and test import/export functionality with safe files.📡 Detection & Monitoring
Log Indicators:
- Unusual import activity patterns
- Multiple failed import attempts
- Import operations accessing unusual file paths
Network Indicators:
- Large XML file uploads to import endpoints
- Unusual outbound connections during import operations
SIEM Query:
source="agiloft" AND (event="import" OR event="export") AND (file_path CONTAINS ".." OR file_path CONTAINS "/etc/" OR file_path CONTAINS "/root/")