CVE-2014-3005: XEE
It was reported [1],[2] that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local file, and send the contents of the specified file to a remote server.
This is fixed upstream via:
svn://svn.zabbix.com/branches/dev/ZBX-8151-18 r46594 for 1.8 svn://svn.zabbix.com/branches/dev/ZBX-8151-20 r46600 for 2.0+
[1] https://support.zabbix.com/browse/ZBX-8151 [2] http://www.pnigos.com/?p=273
Other sources
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3005?
CVE-2014-3005 has a high severity rating due to potential remote code execution risks from parsing crafted XML files.
How do I fix CVE-2014-3005?
To remediate CVE-2014-3005, upgrade Zabbix Server to a version beyond 2.0.3 that has addressed this vulnerability.
What versions of Zabbix are affected by CVE-2014-3005?
CVE-2014-3005 affects Zabbix versions 1.8 through 2.0.3 including multiple updates in between.
Can CVE-2014-3005 lead to data exfiltration?
Yes, CVE-2014-3005 could allow attackers to access sensitive data on the server by leveraging the XML parsing feature.
Is there a workaround for CVE-2014-3005 until I can update?
A temporary workaround for CVE-2014-3005 involves disabling the XML import feature to mitigate the risk.