Critical XXE Vulnerability Discovered in SysAid On-Prem Versions

What changed

A serious vulnerability has been found in SysAid On-Prem, specifically in versions up to and including 23.3.40. This flaw involves improper handling of XML External Entity references, which can be exploited to gain unauthorized access.

The vulnerability allows attackers to execute unauthorized actions, including the potential takeover of administrator accounts and unauthorized file access.

Who is affected

Organizations using SysAid On-Prem versions 23.3.40 or earlier are at risk due to this vulnerability. The following groups should be particularly vigilant:

IT departments managing SysAid installations, as they are responsible for securing the application and its configurations.

• SysAid On-Prem users, especially those in enterprise environments.
• Organizations relying on SysAid for IT service management.
• System administrators who manage SysAid deployments.

What to do

It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Users should prioritize the following steps:

Upgrade to the latest version of SysAid On-Prem to ensure that the vulnerability is patched.

• Review system configurations for potential exposure to XXE attacks.
• Implement additional security measures, such as network segmentation and access controls.
• Monitor logs for any unusual activity that may indicate exploitation attempts.