CVE-2024-6893: Journyx SSRF Vulnerability

CVE-2024-6893 Overview

CVE-2024-6893 is an XML External Entity (XXE) vulnerability [CWE-611] affecting Journyx version 11.5.4 on Linux. The flaw resides in the soap_cgi.pyc API handler, which processes the XML body of Simple Object Access Protocol (SOAP) requests without disabling external entity resolution. An unauthenticated remote attacker can submit a crafted SOAP request that references external entities. Successful exploitation allows the attacker to read arbitrary local files, conduct Server-Side Request Forgery (SSRF) against internal network resources, and exhaust web server resources through entity expansion. KoreLogic published the issue in security advisory KL-001-2024-010.

Critical Impact
Unauthenticated attackers can read local files, pivot through SSRF, and trigger denial-of-service against Journyx 11.5.4 deployments by sending a single crafted SOAP request.

Affected Products

Journyx 11.5.4 on Linux
The soap_cgi.pyc API handler component
SOAP-based integrations exposed by Journyx workforce management

Discovery Timeline

2024-08-08 - CVE-2024-6893 published to the National Vulnerability Database (NVD)
2024-08-08 - KoreLogic Security Advisory KL-001-2024-010 released via Full Disclosure mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6893

Vulnerability Analysis

The vulnerability is an XML External Entity (XXE) flaw in the SOAP request handler soap_cgi.pyc. SOAP messages are XML documents, and the parser used by Journyx resolves external entity declarations contained in the inbound XML body. An attacker submits a SOAP envelope that includes a Document Type Definition (DTD) with an ENTITY declaration pointing to a local file path or remote Uniform Resource Identifier (URI). When the server parses the message, the entity is dereferenced and its contents are reflected in the SOAP response or used to initiate outbound requests. This converts a single unauthenticated request into a file disclosure, SSRF, or resource exhaustion primitive against the host. Recursive or nested entity expansion can also be used to consume CPU and memory, leading to denial of service.

Root Cause

The SOAP parser inside soap_cgi.pyc is configured with external entity resolution enabled and lacks DTD restrictions. No allowlist or sanitization is applied to inbound XML, so any well-formed SOAP envelope containing a <!DOCTYPE> block with SYSTEM or PUBLIC identifiers is processed as authoritative input.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP POST request to the Journyx SOAP endpoint with a SOAP envelope containing a malicious DTD. The DTD references a local file using a file:// URI or an internal host using an http:// URI. The Journyx server resolves the entity and returns its contents in the SOAP response or issues the outbound request on behalf of the attacker. According to the Exploit Prediction Scoring System (EPSS), the probability of exploitation in the next 30 days places this CVE in the top 2% of all published vulnerabilities.

The vulnerability mechanism is documented in the KoreLogic Security Advisory KL-001-2024-010 and the Full Disclosure August 2024 Post.

Detection Methods for CVE-2024-6893

Indicators of Compromise

Inbound HTTP POST requests to Journyx SOAP endpoints containing <!DOCTYPE or <!ENTITY declarations in the XML body.
SOAP request bodies referencing SYSTEM identifiers such as file:///etc/passwd, file:///etc/shadow, or internal IP addresses.
Unexpected outbound connections originating from the Journyx application server to internal hosts or attacker-controlled domains.
Large or nested entity definitions in SOAP traffic indicative of billion-laughs style amplification.

Detection Strategies

Inspect SOAP traffic at the web application firewall (WAF) or reverse proxy layer for DTD and external entity tokens.
Correlate web server access logs with soap_cgi URIs and abnormally large response sizes or extended request durations.
Hunt for Journyx process activity that reads sensitive system files such as /etc/passwd, SSH keys, or application configuration files.

Monitoring Recommendations

Capture full request bodies for the Journyx SOAP endpoint and forward them to a centralized logging platform for retrospective analysis.
Alert on outbound connections from the Journyx host to non-business destinations, including cloud metadata endpoints such as 169.254.169.254.
Baseline normal SOAP payload sizes and flag deviations consistent with entity expansion attacks.

How to Mitigate CVE-2024-6893

Immediate Actions Required

Restrict network access to the Journyx SOAP API to trusted integration hosts using firewall rules or reverse proxy access control lists.
Deploy WAF signatures that block SOAP payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
Audit application logs for prior exploitation attempts referencing file:// URIs or internal hostnames.

Patch Information

No vendor advisory or fixed version is referenced in the NVD record at the time of writing. Administrators should contact Journyx directly and consult the KoreLogic Security Advisory KL-001-2024-010 for remediation guidance and upgrade availability.

Workarounds

Place the Journyx SOAP endpoint behind a reverse proxy that strips or rejects XML documents containing DTD declarations.
Block egress traffic from the Journyx server to untrusted networks to neutralize SSRF and out-of-band data exfiltration.
Run the Journyx service under a dedicated low-privilege account with read access limited to required application files.
Apply request size and timeout limits at the proxy layer to mitigate entity-expansion denial of service.

bash

# Example NGINX reverse proxy rule to block XXE payloads to Journyx SOAP endpoint
location /soap_cgi {
    client_max_body_size 256k;
    client_body_timeout 10s;

    if ($request_body ~* "(<!DOCTYPE|<!ENTITY|SYSTEM\s+\"(file|http|ftp|gopher)://)") {
        return 403;
    }

    proxy_pass http://journyx_backend;
}