CVE-2024-29010: GMS ECM XML External Entity (XXE) Vulnerability

CVE-2024-29010 Overview

CVE-2024-29010 is an XML External Entity (XXE) injection vulnerability in the SonicWall Global Management System (GMS) Enterprise Configuration Management (ECM) URL endpoint. The XML parser processes attacker-supplied XML documents without disabling external entity resolution. Authenticated attackers can craft malicious XML payloads that reference external entities to read local files, probe internal network resources, and disclose sensitive information from the GMS host.

The flaw affects GMS 9.3.4 and earlier versions. It is classified under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Authenticated remote attackers can exfiltrate sensitive files and configuration data from GMS management servers through crafted XML payloads sent to the ECM endpoint.

Affected Products

SonicWall Global Management System (GMS) 9.3.4
SonicWall GMS versions prior to 9.3.4
SonicWall GMS ECM URL endpoint component

Discovery Timeline

2024-05-01 - CVE-2024-29010 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29010

Vulnerability Analysis

The GMS ECM URL endpoint accepts XML documents from authenticated clients and passes them to an XML parser configured to resolve external entities. When the parser encounters a Document Type Definition (DTD) containing an external entity reference, it fetches the referenced resource and substitutes it into the parsed document. Attackers abuse this behavior to instruct the parser to read arbitrary files on the GMS server or perform outbound requests to internal systems.

Exploitation requires network access to the GMS management interface and valid authentication credentials. Once the crafted payload is delivered, the parser returns file contents or triggers Server-Side Request Forgery (SSRF) style probes against internal endpoints. Information disclosed can include configuration files, credentials stored on disk, and metadata used to pivot deeper into the management plane.

Root Cause

The underlying XML parser used by the ECM endpoint does not disable the DOCTYPE declaration and external entity resolution. Secure XML processing requires setting features such as disallow-doctype-decl, external-general-entities=false, and external-parameter-entities=false. The GMS implementation omits these hardening options, leaving the parser in its default, unsafe state.

Attack Vector

The attack is delivered over the network to the GMS ECM URL endpoint. An authenticated attacker with low privileges submits an HTTP request containing an XML document with a malicious DTD. The DTD references either a file:// URI to read local files or an http:// URI to reach internal services. The parser resolves the entity server-side and includes the fetched content in its parsed representation, which is then returned or reflected through the endpoint response.

No verified public proof-of-concept code is available. Consult the SonicWall Security Advisory SNWLID-2024-0007 for vendor technical details.

Detection Methods for CVE-2024-29010

Indicators of Compromise

HTTP POST or PUT requests to the GMS ECM URL endpoint containing <!DOCTYPE or <!ENTITY tokens in the request body
XML payloads referencing SYSTEM identifiers with file://, http://, or ftp:// schemes
Unexpected outbound connections originating from the GMS server to internal or external hosts shortly after ECM endpoint activity
GMS process access to sensitive files such as /etc/passwd, /etc/shadow, or GMS configuration directories not associated with normal operations

Detection Strategies

Inspect web server and application logs for XML content containing DTD declarations submitted to ECM endpoints
Correlate authenticated GMS session activity with outbound network requests from the GMS host to detect SSRF-style entity resolution
Deploy web application firewall (WAF) rules that flag XML bodies containing <!ENTITY or SYSTEM keywords targeting management endpoints

Monitoring Recommendations

Enable verbose HTTP request logging on the GMS management interface and forward logs to a centralized SIEM for XML content inspection
Monitor file access telemetry on GMS servers for reads of sensitive configuration and credential files by the GMS service account
Alert on any egress traffic from GMS servers to non-approved destinations, particularly during authenticated administrative sessions

How to Mitigate CVE-2024-29010

Immediate Actions Required

Upgrade SonicWall GMS to a version later than 9.3.4 as specified in SonicWall Security Advisory SNWLID-2024-0007
Restrict network access to the GMS management interface to trusted administrative networks only
Rotate credentials for any accounts with access to the GMS ECM endpoint and audit recent authenticated sessions
Review GMS server file system and outbound connection logs for signs of prior exploitation

Patch Information

SonicWall has released fixed versions of GMS that address this XXE vulnerability. Refer to SonicWall Security Advisory SNWLID-2024-0007 for the specific patched build numbers and upgrade guidance. Apply the vendor-supplied update to all GMS instances in accordance with your change management process.

Workarounds

Place the GMS management interface behind a VPN or jump host to limit exposure until patching is complete
Deploy WAF or reverse proxy rules that reject XML request bodies containing <!DOCTYPE or <!ENTITY declarations directed at ECM URL paths
Enforce network segmentation so that the GMS server cannot initiate outbound connections to sensitive internal resources

bash

# Example WAF rule concept to block XXE payloads targeting ECM endpoints
# ModSecurity-style rule
SecRule REQUEST_URI "@contains /ecm" \
  "chain,deny,status:403,id:1029010,msg:'Potential XXE against GMS ECM endpoint'"
  SecRule REQUEST_BODY "@rx (?i)<!(DOCTYPE|ENTITY)[^>]*SYSTEM" "t:none"