SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

SysAid On-Prem versions up to 23.3.40 have a security flaw where an attacker can exploit XML processing without logging in to take over administrator accounts or read sensitive files from the server.

An unauthenticated XXE vulnerability exists in the serverurl processing functionality (CWE-611) that allows attackers to inject malicious XML entities. This can be leveraged for arbitrary file disclosure and privilege escalation through administrator account compromise, with no authentication required as a pre-condition.