PT-2024-13676 · Unknown · Kiuwan Sast+1

C. Schwarz + 2 · Published 2024-06-20 · Updated 2024-07-03 · CVE-2023-49110

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kiuwan SAST version master.1808.p685.q13371

Description The issue arises when the Kiuwan Local Analyzer uploads scan results to the Kiuwan SAST web application, which processes XML files containing external entities. This leads to an XML external entity injection attack. An attacker with privileges to scan source code can extract files from the operating system with the application server user's rights, potentially gaining access to sensitive files like configuration and passwords. The attacker can also initiate connections to internal systems for port scans or access other internal functions and applications.

Recommendations For version master.1808.p685.q13371, consider disabling the XML entity resolution feature in the Kiuwan SAST web application until a patch is available. Restrict access to the "Code Security" module to minimize the risk of exploitation. Avoid using the Kiuwan Local Analyzer to upload scan results to the Kiuwan SAST web application until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-49110

Affected Products

Kiuwan Local Analyzer

Kiuwan Sast

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-49110 · Security Note
• https://kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log · Note
• http://seclists.org/fulldisclosure/2024/Jun/3 · Note
• https://r.sec-consult.com/kiuwan · Note
• https://twitter.com/CVEnew/status/1803772890439184825 · Twitter Post