Slovensko.Digital Autogram is vulnerable to an unauthenticated XXE attack that permits server-side request forgery and unauthorized local file disclosure.

This vulnerability involves the improper restriction of XML external entity references within XMLUtils.java, which can be triggered by an unauthenticated remote attacker via the /sign endpoint of the local HTTP server.

The ability for an unauthenticated attacker to access local files and conduct SSRF attacks poses a severe risk to data confidentiality and internal network integrity. With a CVSS score of 8.6, this vulnerability is categorized as High, as it allows for the potential exposure of sensitive configuration files, credentials, or internal service information that could facilitate further system compromise.

Immediate Action: Update the Slovensko.Digital Autogram software to version 2.7.2 or later to include the necessary XML processing restrictions.

Proactive Monitoring: Review web access logs for suspicious requests directed at the /sign endpoint, particularly those containing XML payloads that include external entity declarations.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect incoming XML traffic and block requests containing DOCTYPE declarations or external entity references.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of XXE vulnerabilities, organizations utilizing the affected version of Autogram must prioritize patching. Please ensure all instances are updated to version 2.7.2 immediately to neutralize the risk of unauthorized file access and potential server-side request forgery.