CVE-2023-24187: 
Java vulnerability analysis and mitigation

An XML External Entity (XXE) vulnerability was discovered in ureport v2.2.9 that allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile. The vulnerability was disclosed on February 13, 2023 (NVD, MITRE).

The vulnerability exists in the report saving interface which does not disable external entity parsing when processing XML data. The vulnerable code is located in the file ureport2-core-2.2.9.jar within the com.bstek.ureport.parser.ReportParser.parse method. The program directly reads XML information without configuring restrictions on external entity references, resulting in XXE vulnerability (Venus-WQLab).

The vulnerability allows attackers to read arbitrary files from the operating system, perform SSRF attacks to detect intranet information, and potentially execute denial of service attacks through cyclically called entities. Additionally, the function has no access control, making it accessible to any user (Venus-WQLab).

The vulnerability can be exploited by submitting malicious XML data to the /ureport/designer/saveReportFile endpoint. A proof of concept exists demonstrating how an attacker can read system files like system.ini through crafted XML content containing external entity references (Venus-WQLab).