XXE Injection in NoviGest Desktop App SAFT Import

Executive Summary

This is an XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The app processes XML files using a JAXB Unmarshaller without disabling external entity resolution. An attacker can exploit this by providing a manipulated XML file to read local files accessible to the application process.

Useful 0 Not Useful 0

Detection Guidance

Detecting XXE vulnerabilities typically involves analyzing XML processing in the NoviGest Desktop App. Check if the application logs show XML parsing errors or unusual file access patterns. Monitor network traffic for unexpected outbound connections during XML import operations. Inspect XML files being processed for external entity references like DOCTYPE declarations.

Useful 0 Not Useful 0

Impact Analysis

If you use the NoviGest Desktop App, an attacker could exploit this to read sensitive files on your system if they gain access to the SAFT import feature. If the app runs with high privileges, system files could be exposed, potentially leading to data theft or further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of personal or health data may result in legal penalties, reputational damage, and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the SAFT import feature in NoviGest Desktop App if not required. Update the application to a patched version that disables external entity resolution in the JAXB Unmarshaller. If updating is not possible, restrict file system permissions for the application process to limit file access. Implement network segmentation to isolate the application from sensitive systems.

Useful 0 Not Useful 0