Summary
Kiteworks Email Protection Gateway contains an XML external entity (XXE) weakness in an optional message-processing feature. When that feature is enabled, a remote unauthenticated sender may be able to cause the gateway to read files accessible to its service account and transmit their contents to an attacker-controlled destination.
Affected context
The issue occurs in deployments where the optional message-processing capability is enabled and incoming messages are parsed by an XML processor that permits external entity references. Risk depends on the parser configuration, the gateway service account's file permissions, and whether outbound network access allows retrieved data to leave the environment.
Exploit preconditions
- Attack surface: Internet-facing email message processing
- Required access: Ability to send a message to the gateway; authentication may not be required
- Trigger point: XML parsing during processing of a crafted message
- Required deployment condition: The optional message-processing feature must be enabled
- Why exploitation is possible: External entity resolution allows document content to reference local resources or external destinations without sufficiently restricting those references
Why this happens
The parser accepts or resolves external entity references supplied through untrusted XML content. This behavior allows document data to influence resource resolution during parsing, rather than treating the message as inert data. The flaw maps to CWE-611: Improper Restriction of XML External Entity Reference, commonly known as XXE.
Potential impact
- The gateway may disclose readable local files
- Cryptographic keys, credentials, or configuration data could be exposed
- Sensitive information may be transmitted to an attacker-controlled destination
- The gateway service account or connected systems could be placed at greater risk
- Follow-on compromise could occur if disclosed secrets are reusable
General mitigation guidance
Mitigation generally focuses on making XML parsing secure by default and reducing trust in message-controlled parser behavior.
Common defensive patterns include:
- Disable external entity resolution and external resource loading
- Use hardened, non-expanding XML parser configurations
- Apply strict XML schemas and reject unsupported document features
- Restrict outbound network access from the gateway processing service
- Run the service with a least-privilege account and minimal filesystem access
- Keep cryptographic keys and credentials outside broadly readable service paths
- Disable optional message-processing features when they are not required
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules identifying XML parsers with external entity processing enabled
- Code review checks for parser configuration and unsafe defaults
- Dependency and configuration reviews covering XML libraries and message-processing features
- Runtime monitoring for unexpected file reads, DNS lookups, or outbound connections from the gateway
- Network policy enforcement that limits egress from email-processing components
- Automated security review tools that flag XXE-prone parser settings
