Kiuwan SAST Vulnerability: XML External Entity Injection Attack

CVE-2023-49110

What is CVE-2023-49110?

The vulnerability in Kiuwan SAST arises during the server-side processing of XML files contained in ZIP archives uploaded from the Kiuwan Local Analyzer. When external XML entities are resolved, an attacker with scanning privileges can exploit this to access sensitive files on the operating system. This can lead to extraction of confidential data like passwords and configuration files. Furthermore, this flaw opens pathways for initiating connections to internal systems, allowing further attacks such as port scans or unauthorized access to internal applications.

References