CVE-2026-50782: Jinher OA C6 XXE Vulnerability

CVE-2026-50782 Overview

CVE-2026-50782 is an XML External Entity (XXE) injection vulnerability in Jinher OA C6. The flaw resides in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can submit a crafted XML payload that causes the server-side XML parser to resolve external entities. Successful exploitation enables arbitrary file read from the underlying server through an out-of-band (OOB) channel. Because the endpoint requires no authentication, exploitation is achievable over the network without prior access.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from Jinher OA C6 servers, exposing configuration files, credentials, and sensitive business data.

Affected Products

Jinher OA C6
/c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint
Deployments exposing the Jinher OA C6 web interface to untrusted networks

Discovery Timeline

2026-07-29 - CVE-2026-50782 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-50782

Vulnerability Analysis

The vulnerability is a classic XML External Entity injection [CWE-611] in an ASP.NET endpoint of Jinher OA C6. The GetXmlHttp handler accepts XML content in the request body and parses it with an XML reader that resolves external entities and external Document Type Definitions (DTDs). An attacker submits an XML document that declares an external entity referencing a local file or a remote DTD hosted on attacker-controlled infrastructure. The parser dereferences the entity, embeds the file contents into the parsed document, and exfiltrates the data through an out-of-band channel. This OOB pattern is used because the endpoint may not echo the parsed XML directly to the response, so the attacker forces the server to send captured file contents to an external listener.

Root Cause

The root cause is unsafe XML parser configuration. The parser processes untrusted XML with external entity resolution and DTD processing enabled by default. Secure defaults for .NET XmlReader or XmlDocument require setting DtdProcessing = DtdProcessing.Prohibit and providing a null XmlResolver. The affected component does neither.

Attack Vector

An unauthenticated remote attacker sends an HTTP POST request to /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp containing an XML body that defines a parameter entity pointing to an attacker-hosted DTD. The remote DTD contains a nested entity that reads a local file such as C:\Windows\win.ini or application configuration files, then transmits its base64-encoded contents to an attacker-controlled listener via an HTTP request. Refer to the public proof-of-concept repository for payload structure and reproduction steps.

Detection Methods for CVE-2026-50782

Indicators of Compromise

Inbound HTTP POST requests to /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp with Content-Type: text/xml or application/xml
Request bodies containing <!DOCTYPE, <!ENTITY, SYSTEM, or file:// tokens
Outbound HTTP or FTP connections initiated by the Jinher OA C6 IIS worker process (w3wp.exe) to unfamiliar external hosts
DNS lookups from the web server for domains that were not previously observed in baseline traffic

Detection Strategies

Deploy web application firewall (WAF) rules that inspect XML request bodies for DOCTYPE declarations and external entity references
Monitor process behavior of w3wp.exe for outbound network connections and file read activity on sensitive paths
Enable IIS request logging and alert on POST traffic to the vulnerable endpoint from external IP ranges
Correlate web server access logs with egress firewall logs to detect out-of-band exfiltration patterns

Monitoring Recommendations

Baseline expected outbound destinations from the Jinher OA server and alert on deviations
Capture full request bodies for the HrmAttendance module to support forensic review
Alert on DNS queries originating from web servers to newly registered or low-reputation domains
Review authentication and access logs for anomalous administrative actions following any suspected XXE activity

How to Mitigate CVE-2026-50782

Immediate Actions Required

Restrict network access to the Jinher OA C6 web interface, limiting exposure to trusted internal networks or VPN users
Block inbound requests to /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp at the reverse proxy or WAF until a patch is applied
Contact Jinher for an official security update and apply it as soon as it becomes available
Rotate credentials and secrets stored in configuration files that may have been exposed on affected systems

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry for CVE-2026-50782. Administrators should contact Jinher directly for remediation guidance and monitor the public proof-of-concept repository and vendor channels for updated fix information.

Workarounds

Configure the reverse proxy or WAF to reject XML payloads containing <!DOCTYPE or <!ENTITY declarations targeting the affected endpoint
Disable DTD processing and external entity resolution in the underlying .NET XML parser by setting DtdProcessing = DtdProcessing.Prohibit and XmlResolver = null
Apply egress filtering on the web server to block outbound HTTP, HTTPS, and DNS traffic to non-approved destinations, disrupting OOB exfiltration
Segment the Jinher OA C6 host from sensitive file shares and credential stores to limit blast radius if arbitrary file read succeeds

bash

# Example WAF rule concept (ModSecurity) to block XXE payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp" \
    "chain,phase:2,deny,status:403,id:1026507820,msg:'Potential XXE against Jinher OA C6'"
    SecRule REQUEST_BODY "@rx (?i)(<!DOCTYPE|<!ENTITY|SYSTEM\s+\"|file://)" "t:none"