CyberRota Analysis
AI-GeneratedDatavane TIS v5.0.0 is vulnerable to an XML external entity (XXE) injection that enables authenticated attackers to exploit the doEditWorkflow endpoint, leading to server-side request forgery and potential out-of-band file exfiltration. By submitting a specially crafted taskScript payload, attackers can manipulate the server to make unauthorized outbound HTTP requests and access sensitive local files, including configuration files and database credentials. Organizations using this version of Datavane TIS should prioritize patching this vulnerability to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.