CVE-2023-26058
XML External Entity (XXE) Vulnerability in Nokia NetAct

The Input validation and proper XML parsers configuration was insufficient in NetAct. On the Configuration Dashboard page, XML files can be uploaded. Enabled support of External Entity will process such files and potentially exploit Arbitrary File Read and SSRF.

This vulnerability is very difficult to be exploited from external, because a few dynamically created parameters (e.g. Jsession-id, CSRF token and Nxsrf tokens) would be needed. The attack can only be performed by an internal user.

Fix has been provided on top of NetAct 22

• Vladimir Razov from Positive Technologies
• Aleksandr Ustinov from Positive Technologies