CVE-2021-37425

What it actually does

Altova MobileTogether Server versions before 7.3 SP1 improperly process attacker-supplied XML in the workflow management interface, enabling XML External Entity (XXE) injection. Because the vulnerable endpoint is network-accessible and does not require authentication, an attacker can submit crafted XML that causes the server-side XML parser to resolve external entities. This can expose local files readable by the MobileTogether Server process, including mobiletogether server configuration data, certificates, and private keys. Depending on parser behavior and environment, the flaw may also support out-of-band data exfiltration and denial-of-service conditions through malicious entity expansion or external resource retrieval.

Why it matters to the business

Successful exploitation can disclose highly sensitive server-side secrets, including configuration files and TLS/private key material, which can undermine trust in the application, enable follow-on compromise, and require certificate/key rotation. Because exploitation is unauthenticated, remotely reachable deployments are at elevated risk, especially where MobileTogether Server is exposed to the internet. The high CVSS score, high EPSS likelihood, and public exploit availability make this a priority even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed Altova MobileTogether Server instance running a version earlier than 7.3 SP1. They then send a crafted XML request to the workflow management functionality, commonly targeting /workflowmanagement and abusing XML structures associated with InfoSetChanges or Changes. The malicious XML declares an external entity that references a local file or attacker-controlled external resource. When the server parses the XML, the XML parser resolves the entity in the server context and embeds or transmits the referenced content. The attacker may first read mobiletogetherserver.cfg to learn configuration details, file locations, certificate paths, and private key paths, then issue additional XXE requests to retrieve those files. With certificate and private key material, the attacker may decrypt traffic where applicable, impersonate services, facilitate man-in-the-middle attacks, or use the exposed secrets for broader intrusion activity.

How to fix it

Upgrade Altova MobileTogether Server to version 7.3 SP1 or later. If an upgrade cannot be completed immediately, restrict network access to MobileTogether Server management and workflow endpoints to trusted administrative networks only, block unauthenticated external access to /workflowmanagement where operationally feasible, and place compensating controls such as a WAF or reverse proxy rule to reject XML requests containing external entity declarations, DOCTYPE declarations, or file/URL entity references. Rotate any certificates, private keys, credentials, API keys, or secrets that may have been accessible to the MobileTogether Server process, especially if logs show suspicious requests to /workflowmanagement. Disable external entity resolution in XML parsers if configurable, and verify MobileTogether Server is not running with unnecessary filesystem privileges.

How to confirm the fix worked

Confirm the installed Altova MobileTogether Server version is 7.3 SP1 or later. Review application release/build information from the administrative console, installed package metadata, service binaries, or vendor-provided version commands. Confirm that /workflowmanagement is not anonymously reachable from untrusted networks unless explicitly required and protected. Validate that XML parser hardening or WAF controls reject requests containing DOCTYPE, ENTITY, SYSTEM, PUBLIC, file://, http://, or https:// external entity references. After patching, perform an authorized non-destructive XXE validation using a benign external entity reference to a controlled callback host and confirm no outbound lookup or callback occurs and no local file content is returned.

Typical attack path

1. Discover an internet-facing or network-accessible Altova MobileTogether Server instance.
2. Fingerprint the server version or infer vulnerability from exposed behavior, headers, paths, or application responses.
3. Send a crafted XML request to /workflowmanagement using vulnerable workflow management XML elements such as InfoSetChanges or Changes.
4. Abuse XXE processing to read local files, commonly starting with mobiletogetherserver.cfg.
5. Use configuration data to identify additional sensitive file locations, including certificate and private key paths.
6. Submit follow-on XXE requests to retrieve certificates, private keys, or other sensitive server-readable files.
7. Use stolen secrets for impersonation, traffic interception, credential discovery, or further lateral movement.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, reverse proxy logs, WAF events, MobileTogether application logs, and endpoint telemetry from servers running Altova MobileTogether Server. Focus on requests to /workflowmanagement containing XML external entity syntax, especially DOCTYPE or ENTITY declarations, SYSTEM or PUBLIC identifiers, file:// references, or workflow XML elements such as InfoSetChanges and Changes. Look for attempts to read mobiletogetherserver.cfg, operating system files, certificate files, private keys, or other local paths. Examine outbound DNS, HTTP, HTTPS, LDAP, SMB, and FTP connections from MobileTogether Server hosts around the time of suspicious requests, because XXE payloads often exfiltrate data through attacker-controlled callback infrastructure. On the host, review whether configuration files, certificate files, or key files were accessed unexpectedly by the MobileTogether Server process. If logs show exploitation patterns, conduct incident response assuming exposed local files and secrets may have been disclosed.

• /workflowmanagement
• InfoSetChanges
• Changes
• <!DOCTYPE
• <!ENTITY
• SYSTEM "file://
• SYSTEM 'file://
• PUBLIC "
• PUBLIC '
• file:///
• mobiletogetherserver.cfg
• /etc/passwd
• /etc/shadow
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• .pem
• .key
• .pfx
• .p12
• xxe
• XML External Entity

What your security team should do

• Prioritize patching all Altova MobileTogether Server deployments to 7.3 SP1 or later due to unauthenticated remote exploitability and public exploit availability.
• Immediately inventory externally exposed MobileTogether Server instances and restrict access to /workflowmanagement from the internet.
• Search web, reverse proxy, WAF, and application logs for XXE payload indicators targeting /workflowmanagement, especially requests containing InfoSetChanges, Changes, DOCTYPE, ENTITY, SYSTEM, PUBLIC, file://, or references to mobiletogetherserver.cfg.
• If suspicious activity is found, assume secrets readable by the MobileTogether Server process may be compromised and rotate certificates, private keys, credentials, and integration secrets.
• Review outbound network logs for unusual HTTP, DNS, or LDAP callbacks from MobileTogether Server hosts, which may indicate out-of-band XXE exfiltration attempts.
• Add SIEM detections and WAF signatures for XML external entity patterns against MobileTogether Server endpoints.
• Harden service permissions so the MobileTogether Server process can only read files required for operation.