OpenRemote versions prior to 1.22.0 are susceptible to an XXE vulnerability that allows authenticated attackers to perform server-side file disclosure and SSRF attacks.

The vulnerability exists in the Velbus asset import path, which fails to properly sanitize XML input. An authenticated user with access to the import endpoint can exploit this to perform XML external entity processing, leading to the disclosure of files under 1023 characters or Server-Side Request Forgery (SSRF).

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive configuration files or internal system data. Furthermore, the SSRF capability allows an attacker to probe internal network resources, potentially bypassing perimeter security controls. With a CVSS score of 7.6, this vulnerability poses a significant risk to the confidentiality and integrity of the platform, justifying immediate remediation.

Immediate Action: Update the OpenRemote manager component to version 1.22.0 or later to apply the necessary XML hardening.

Proactive Monitoring: Monitor server access logs for anomalous requests to the Velbus import endpoint, particularly those containing suspicious XML patterns or unexpected external entity references.

Compensating Controls: Ensure that the OpenRemote application is deployed within a segmented network environment to limit the impact of potential SSRF attacks, and restrict access to the import functionality to trusted user accounts only.

Public Exploit Available: No confirmed public exploit exists.

Given the potential for unauthorized data access and internal network reconnaissance, organizations should prioritize upgrading their OpenRemote instances to version 1.22.0. Security teams must ensure that the update is applied immediately to eliminate the underlying XXE flaw and prevent potential exploitation by malicious actors.