CyberRota Analysis
AI-GeneratedExterro FTK Imager versions prior to 8.3 are vulnerable to an XML external entity (XXE) injection, which allows attackers to read arbitrary files from the host filesystem by exploiting malicious external entity references within a Report.xml file in a UFDR ZIP archive. This vulnerability can lead to unauthorized data exfiltration when the crafted UFDR archive is processed by the application. Organizations using FTK Imager for digital forensics should prioritize patching to mitigate the risk of data leakage.
Original NVD Description
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item. Attackers can craft a malicious UFDR archive that, when previewed by an examiner, causes the XML parser to resolve file:// external entity references and execute msxsl:script within the external stylesheet to exfiltrate the resolved file contents to an attacker-controlled endpoint via a generated image URL.