CVE-2019-16188 : Security Advisory and Response

HCL AppScan Source versions prior to 9.03.13 are vulnerable to XML External Entity (XXE) attacks, allowing attackers to extract sensitive information and potentially launch denial of service attacks.

Understanding CVE-2019-16188

What is CVE-2019-16188?

HCL AppScan Source before version 9.03.13 is susceptible to XXE attacks, enabling malicious actors to exfiltrate data from the victim's local file system.

The Impact of CVE-2019-16188

The vulnerability can lead to information disclosure and denial of service attacks due to the product's lack of disabling external XML Entity Processing.

Technical Details of CVE-2019-16188

Vulnerability Description

Attackers can exploit the vulnerability by sending a crafted .ozasmt file to a victim and convincing them to open it, leading to data extraction.

Affected Systems and Versions

HCL AppScan Source versions prior to 9.03.13

Exploitation Mechanism

Sending a specially crafted .ozasmt file to a victim and having them import it into AppScan Source

Mitigation and Prevention

Immediate Steps to Take

Update HCL AppScan Source to version 9.03.13 or later
Be cautious when opening files from unknown or untrusted sources

Long-Term Security Practices

Regularly update software to the latest versions
Educate users on the risks of opening files from unfamiliar sources

Patching and Updates

Apply patches and security updates provided by HCL to address the vulnerability