Intland codeBeamer XXE Vulnerability (CVE-2020-26513) Analysis and Fix

Critical Vulnerability Information Vulnerability Summary Product: codeBeamer Application Lifecycle Management (ALM) Vendor: Intland Software CSNC ID: CSNC-2020-008 CVE ID: CVE-2020-26513 Subject: XML External Entity Resolution (XXE) Risk: High Effect: Remotely exploitable Affected Versions Vulnerable: - 10.0.0-final - 10.1.0-final - 10.1.SP4 Not Vulnerable: 20.11-lts Technical Description Core Issue: Improper configuration of the XML parser, allowing resolution of external entities. Attack Method: Exploiting a specially crafted ReqIF file to trigger entity deserialization, leading to an XXE attack. Attack Steps: 1. Use the Export feature to obtain a ReqIF file template. 2. Modify the ReqIF file to configure an external entity that reads the file. 3. Compress the file into format and import it into the codeBeamer application. 4. The XML parser processes the file and leaks the content of the specified file. Example Attack Request Example Response Leaked File Content: C:\Windows\win.ini Remediation Recommendations Root Cause: Improper configuration of the XML parser. Fix: Harden XML parser configuration by disabling inline DTDs and external entities. Timeline 2020-05-14: Vulnerability discovered 2020-05-18: Initial notification to vendor 2020-12-01: Patched version released 2020-12-07: Public disclosure References [1] https://inland.com/codebeamer/application-lifecycle-management/ [2] https://codebeamer.com/cb/wiki/199594 [3] https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Goal Reached Thanks to every supporter — we hit 100%!

Intland codeBeamer XXE Vulnerability (CVE-2020-26513) Analysis and Fix