SOCT GXP Vulnerability Advisory: XXE, RCE, Unauth Access (CVE-2022-5937 to 5944)

Critical Vulnerability Information 1. XXE in SOCT GXP File Processing (CVE-2022-5937) Description: XXE vulnerability in SOCT GXP file processing, allowing attackers to execute arbitrary commands via specially crafted XML files. Affected Versions: SOCT GXP v4.6.0.3 and earlier. Discovery and Reporting: NCC Group - James Kettle. 2. Reflected Cross-Site Scripting in GXP Job Service (CVE-2022-5938) Description: Reflected XSS vulnerability in GXP Job Service, allowing attackers to inject malicious scripts via specially crafted requests. Affected Versions: SOCT GXP v4.6.0.2 and earlier. Discovery and Reporting: NCC Group - James Kettle. 3. Command Injection in SOCT GXP Job Service (CVE-2022-5939) Description: Command injection vulnerability in SOCT GXP Job Service, allowing attackers to execute arbitrary commands via specially crafted requests. Affected Versions: SOCT GXP v4.6.0.2 and earlier. Discovery and Reporting: NCC Group - James Kettle. 4. Path Traversal may allow arbitrary file read in SOCT GXP Job Service (CVE-2022-5940) Description: Path traversal vulnerability in SOCT GXP Job Service, allowing attackers to read arbitrary files. Affected Versions: SOCT GXP v4.6.0.2 and earlier. Discovery and Reporting: NCC Group - James Kettle. 5. Unauthenticated access to the GXP Job Service on Port 44443 (CVE-2022-5941) Description: Unauthenticated access to GXP Job Service on port 44443, allowing attackers to access the service without authentication. Affected Versions: SOCT GXP v4.6.0.2 and earlier. Discovery and Reporting: NCC Group - James Kettle. 6. Unauthenticated access to the GXP Job Status service on Port 44447 (CVE-2022-5942) Description: Unauthenticated access to GXP Job Status service on port 44447, allowing attackers to access the service without authentication. Affected Versions: SOCT GXP v4.6.0.2 and earlier. Discovery and Reporting: NCC Group - James Kettle. 7. Client-Side Request Forgery in the GXP Job Status Service (CVE-2022-5943) Description: Client-side request forgery vulnerability in GXP Job Status Service, allowing attackers to forge requests. Affected Versions: SOCT GXP v4.6.0.2 and earlier. Discovery and Reporting: NCC Group - James Kettle. 8. Information Disclosure in the GXP Job Status Service (CVE-2022-5944) Description: Information disclosure vulnerability in GXP Job Status Service, allowing attackers to obtain sensitive information. Affected Versions: SOCT GXP v4.6.0.2 and earlier. Discovery and Reporting: NCC Group - James Kettle.

Goal Reached Thanks to every supporter — we hit 100%!

SOCT GXP Vulnerability Advisory: XXE, RCE, Unauth Access (CVE-2022-5937 to 5944)