CVE-2023-26057
XML External Entity (XXE) Vulnerability in Nokia NetAct

Input validation and proper XML parsers configuration was missing. For an external attacker , it is very difficult to exploit it , because to form this exploit , few dynamically created parameters line Jsession-id, CSRF token and Nxsrf tokens would be needed. The attack can only be performed by an internal user.

On the Perfomance Manager+ page, attackers can import XML files. Support of external entities is enabled for processing of such files, which leads to Arbitrary File Read and SSRF.

Fix has been provided on top of NetAct 22

• Vladimir Razov from Positive Technologies
• Aleksandr Ustinov from Positive Technologies