CVE-2019-9892

Vulnerability

An XML external entity (XXE) processing flaw exists in the Report Statistics XML import functionality of Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. When an agent user with appropriate permissions imports a specially crafted Report Statistics XML file, the parser does not properly disable external entity resolution, allowing the inclusion of external files from the filesystem [1].

Exploitation

An attacker must be logged into OTRS as an agent user with the necessary permissions to import Report Statistics XML files. The attacker crafts an XML document that defines an external entity pointing to a local file (e.g., /etc/passwd). Upon import, the OTRS XML parser resolves the entity and includes the file content in the resulting data [1]. No additional privileges or user interaction beyond the agent's existing permissions are required.

Impact

Successful exploitation allows the attacker to read arbitrary files from the OTRS server's filesystem. The file content is returned within the application's response or stored in a location accessible to the attacker, leading to disclosure of sensitive information such as configuration files, credentials, or other confidential data [1].

Mitigation

The issue is addressed in OTRS 5.0.35, 6.0.18, and 7.0.7 [1]. Users should upgrade to these or later versions immediately. OTRS 6.x is end-of-life and no longer receives security updates, so users on 6.x should migrate to a supported version [1]. No workaround is available if upgrading is not possible; the import functionality should be restricted to trusted users only.