XML External Entity Injection Vulnerability in ETQ Reliance by ETQ

CVE-2025-34142

What is CVE-2025-34142?

An XML External Entity (XXE) injection vulnerability has been identified in ETQ Reliance's CG (legacy) platform, specifically affecting the /resources/sessions/sso endpoint. The vulnerability arises from the SAML authentication handler's failure to disable external entity resolution when processing XML input. This oversight allows malicious actors to craft SAML responses that can leverage external entity references, potentially leading to unauthorized access to sensitive files or enabling server-side request forgery (SSRF). ETQ has addressed this issue in newer versions by implementing a fix that disables external entity processing within the XML parser.

References