PT-2021-18623 · Assyst 10 · Assyst 10

Published 2021-09-15 · Updated 2021-09-28 · CVE-2021-30137

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Assyst 10 version SP7.5

Description The issue allows for authenticated XXE (XML External Entity) attacks, leading to Server-Side Request Forgery (SSRF) via XML unmarshalling. This occurs because the application permits users to send JSON or XML data to the server, and it was possible to inject malicious XML data through several access points.

Recommendations For Assyst 10 version SP7.5, consider disabling XML data processing until a patch is available to prevent malicious XML data injection. Restrict access to the XML unmarshalling functionality to minimize the risk of SSRF exploitation. Avoid using XML data in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-30137

Affected Products

Assyst 10

References · 5

• 🔥 https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-30137 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30137 · Vendor Advisory
• https://t.me/cvenotify/21548 · Telegram Post
• https://t.me/cvenotify/20893 · Telegram Post