CVE-2023-7307: Sangfor Behavior Management System XML External Entity Injection
Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity definitions, leading to potential disclosure of internal files, server-side request forgery (SSRF), or other impacts depending on parser behavior. The vulnerability is due to improper configuration of the XML parser, which allows resolution of external entities without restriction. This product is now integrated into their IAM (Internet Access Management) platform and an affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-09-06 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-7307?
CVE-2023-7307 is considered a high-severity vulnerability due to its potential for remote unauthenticated exploitation.
How can I mitigate CVE-2023-7307?
To mitigate CVE-2023-7307, ensure that XML processing is disabled or tightly restricted, and validate XML input thoroughly.
What is the impact of CVE-2023-7307?
CVE-2023-7307 allows remote attackers to perform XML external entity injection, potentially leading to data exposure or server-side request forgery.
Which version of Sangfor Behavior Management System is affected by CVE-2023-7307?
All versions of the Sangfor Behavior Management System that contain the /src/sangforindex endpoint are affected by CVE-2023-7307.
Is CVE-2023-7307 easy to exploit?
Yes, CVE-2023-7307 can be easily exploited by a remote unauthenticated attacker through crafted XML data.