cbcvebase.
CVE-2018-11586
published 2018-06-05

CVE-2018-11586: XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct…

PriorityP270critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
15.17%
96.3th percentile
XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Affected

1 ranges
VendorProductVersion rangeFixed in
searchbloxsearchblox——

Detection & IOCsextracted from sources · hover to see the quote

urlapi/rest/status↗
filenameext.dtd↗
command%dtd; %all; %send;↗
  • →Monitor HTTP POST requests to the endpoint `api/rest/status` containing XML payloads with DOCTYPE declarations and external entity references, which are characteristic of XXE exploitation against SearchBlox 8.6.7. ↗
  • →Detect Out-of-Band XXE (OOB-XXE) exploitation patterns: look for outbound HTTP requests from the SearchBlox server fetching a remote `.dtd` file (e.g., `ext.dtd`) shortly after an inbound XML request to `api/rest/status`, indicating data exfiltration via DNS/HTTP callback. ↗
  • →Alert on unauthenticated requests to `api/rest/status` — the vulnerability is exploitable without authentication, so any XML body with a DTD from an unauthenticated source should be treated as suspicious. ↗
  • ·The exploit demonstrates OOB-XXE using a two-stage payload: the initial XML request loads a remote DTD (`ext.dtd`) which then triggers a secondary HTTP callback carrying exfiltrated data. Detection must account for both the inbound malicious XML and the outbound callback traffic. ↗
  • ·The attacker-controlled HTTP server in the exploit runs on port 7000, but in real-world attacks any arbitrary port could be used for the OOB callback; do not rely solely on port 7000 for detection. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.