CVE-2018-14473

Vulnerability

OCS Inventory version 2.4.1 is vulnerable to XML External Entity (XXE) injection due to improper configuration of the XML parser. The parser does not disable external entities, allowing an attacker to inject malicious XML content. This affects the endpoints that process XML data received from agents or other sources.

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request containing an XML payload with an external entity reference. No authentication is required. The attacker must be able to reach the OCS Inventory server's XML processing interface. The request triggers the parser to resolve the external entity, which can be a local file or a network resource.

Impact

Successful exploitation enables an attacker to exfiltrate sensitive files from the server (e.g., configuration files with credentials) or cause a denial of service by exhausting server resources through recursive entity expansion. The impact may also include server-side request forgery if the external entity references internal network resources [1].

Mitigation

Upgrade to a patched version of OCS Inventory where the XML parser is configured securely (e.g., disabling external entities). The vendor released a fix after this vulnerability was reported [1]. If upgrading is not immediately possible, consider applying input validation and restricting XML parsing options. No workaround is documented for this specific issue.