CVE-2025-2775

What it actually does

SysAid On-Prem versions 23.3.40 and earlier contain an unauthenticated XML External Entity vulnerability in Checkin processing. A remote attacker can submit crafted XML that causes the server-side XML parser to resolve external entities, enabling arbitrary local file read and, according to the vulnerability description, administrator account takeover. The flaw does not require prior authentication, so any exposed vulnerable SysAid On-Prem instance is a viable target.

Why it matters to the business

A successful attack can let an external attacker take control of the SysAid administrative interface and read sensitive files from the server, potentially exposing credentials, configuration secrets, tickets, asset data, and operational support information. Because this issue is listed in CISA KEV, has active in-the-wild exploitation, and had a CISA remediation deadline of 2025-08-12, unpatched internet-facing deployments should be treated as high-priority incident-response candidates, not routine patching items.

How an attack unfolds

An attacker first identifies an exposed SysAid On-Prem instance running version 23.3.40 or earlier. They then send a crafted unauthenticated XML payload to the Checkin processing functionality containing a malicious DOCTYPE and external entity definition. If the XML parser resolves the entity, the server reads attacker-specified local files or makes outbound requests to attacker-controlled infrastructure. The attacker uses this file-read primitive to obtain sensitive configuration data, credentials, tokens, or other application secrets, and then leverages the exposed material or vulnerable workflow to take over an administrator account. After gaining administrative access, the attacker can change configuration, create accounts, access service desk data, and use the platform as a foothold for further internal activity.

How to fix it

Upgrade SysAid On-Prem to a version later than 23.3.40 or the latest vendor-supported fixed release. If immediate upgrade is not possible, restrict external access to SysAid, place the application behind VPN or trusted administrative networks, block unauthenticated access to Checkin processing paths where feasible, and enforce outbound egress filtering from the SysAid server to prevent XML parser callbacks to untrusted hosts. Ensure XML parsing is configured to disable DTDs, external entities, and external schema resolution. After remediation, rotate SysAid administrator credentials and any secrets stored on or readable by the SysAid server if exploitation cannot be confidently ruled out.

How to confirm the fix worked

Confirm the installed SysAid On-Prem version is greater than 23.3.40 or matches the vendor-designated fixed release. Verify unauthenticated requests to Checkin processing do not accept XML containing DOCTYPE or external entity declarations. In a controlled test, submit a benign XXE canary payload referencing an approved internal sinkhole or collaborator endpoint and confirm the SysAid server does not make an outbound DNS or HTTP request. Review application configuration and code-level XML parser settings where available to confirm DTD and external entity resolution are disabled. Also validate that network controls prevent the SysAid server from initiating arbitrary outbound connections.

Typical attack path

1. Reconnaissance for internet-accessible SysAid On-Prem instances.
2. Version or behavior check to determine whether the instance is likely running SysAid On-Prem 23.3.40 or earlier.
3. Unauthenticated submission of crafted XML to the Checkin processing functionality.
4. Use of XXE payloads containing DOCTYPE, ENTITY, file://, or outbound URL references to test parser behavior.
5. Reading sensitive local files or forcing outbound callbacks to attacker-controlled infrastructure.
6. Extraction of credentials, secrets, or administrator takeover material from readable files or responses.
7. Administrator account takeover or creation of privileged access within SysAid.
8. Post-compromise access to tickets, assets, configuration data, and possible lateral-movement opportunities.

How to detect it

Investigate web, reverse proxy, WAF, SysAid application, EDR, DNS, and outbound proxy logs for signs of malicious XML submitted to Checkin processing. Focus on unauthenticated requests containing XML DTD or entity syntax, local file URI references, Windows or Linux sensitive file paths, or references to external attacker-controlled domains. Review SysAid administrative audit logs for new administrator accounts, unexpected password changes, privilege changes, API token creation, integration changes, or configuration edits following suspicious Checkin requests. Examine host telemetry for the SysAid service account reading unusual local files and for unexpected outbound DNS or HTTP traffic originating from the SysAid server. Because exploitation is confirmed in the wild, absence of a blocked WAF event is not sufficient; look for successful requests, unusual response sizes, outbound callbacks, and administrative changes that occurred shortly afterward.

• <!DOCTYPE
• <!ENTITY
• SYSTEM "file://
• SYSTEM 'file://
• PUBLIC "-//
• file:///etc/passwd
• file:///etc/shadow
• file:///proc/self/environ
• file:///C:/Windows/win.ini
• file:///C:/Windows/System32/drivers/etc/hosts
• file:///C:/Program Files/SysAid
• file:///C:/Program Files (x86)/SysAid
• Checkin
• checkin
• ENTITY %
• %xxe;
• %file;
• SYSTEM "http://
• SYSTEM 'http://
• SYSTEM "https://
• SYSTEM 'https://

What your security team should do

• Treat exposed SysAid On-Prem versions 23.3.40 and earlier as potentially compromised because the vulnerability is in CISA KEV and exploitation is active in the wild.
• Patch or upgrade immediately to a version later than 23.3.40 or the latest vendor-supported fixed release.
• If patching cannot be completed immediately, remove public exposure and restrict access to trusted networks or VPN until upgraded.
• Search historical logs for unauthenticated Checkin requests containing XML entity markers such as DOCTYPE, ENTITY, SYSTEM, PUBLIC, file://, or unusual outbound URLs.
• Review outbound DNS, HTTP, and proxy logs from SysAid servers for connections to unknown external hosts around suspicious Checkin activity.
• Audit SysAid administrator accounts, recent password resets, role changes, new users, API keys, integrations, and configuration changes.
• Rotate SysAid administrator credentials and any credentials or secrets stored in application configuration if exploitation is suspected or cannot be excluded.
• Preserve application, web server, proxy, EDR, and network logs before remediation if incident response may be required.