PT-2020-15366 · Halo · Halo

Any-How · Published 2020-09-30 · Updated 2020-10-08 · CVE-2020-21524

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions halo version 1.1.3

Description The issue is related to a XML external entity (XXE) vulnerability. It affects the function of importing other blogs in the background, specifically through the /api/admin/migrations/wordpress endpoint, which parses XML files without proper security defenses. This vulnerability can be exploited to detect intranet settings, read files, and potentially enable DDoS attacks.

Recommendations For halo version 1.1.3, as a temporary workaround, consider disabling the XML parsing function in the /api/admin/migrations/wordpress endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint for importing blogs from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-21524

Affected Products

Halo

References · 3

• 🔥 https://github.com/halo-dev/halo/issues/423 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-21524 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21524 · Vendor Advisory