CVE-2021-28973

Vulnerability

The XML Import functionality in the Administration console of Perforce Helix ALM version 2020.3.1 Build 22 (and potentially earlier versions) accepts XML input that is parsed by an insecurely configured XML parser, resulting in XML External Entity (XXE) injection [1]. The vulnerability exists in the import feature accessible via the administration console's left menu under 'XML Import'. The parser does not disable DTDs or external entity resolution [1].

Exploitation

An attacker with network access to the Helix ALM administration console can craft a malicious XML payload containing an external entity reference (e.g., file:///C:/Windows/win.ini). The attacker logs in, navigates to the 'XML Import' page, browses to the malicious XML file, and clicks the 'Validate' button [1]. The server processes the XML, resolves the external entity, and reflects the file contents in an error message [1]. No authentication beyond valid admin console credentials is required if the attacker has those; the reference does not specify whether authentication is needed, but the administration console typically requires admin privileges.

Impact

Successful exploitation allows an attacker to read arbitrary files from the server's file system with the privileges of the Helix ALM service account [1]. This can lead to disclosure of sensitive configuration data, credentials, or other confidential information. The attack is remote and does not require user interaction beyond the attacker performing the import steps [1].

Mitigation

Perforce has addressed the issue in Helix ALM version 2021.1.0 [1]. Users should upgrade to this version or later. If upgrading is not immediately possible, administrators should restrict access to the administration console and validate all XML input before processing. No workaround is provided in the reference. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.