CVE-2026-57917 in proCertum SmartSign
Summary
by MITRE • 07/27/2026
proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerability is triggered simply by previewing a file in the file selection window, before the victim clicks “Open”.
This issue was fixed in version 9.4.3.90.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/27/2026
The proCertum SmartSign application presents a critical server-side request forgery vulnerability through its XML external entity processing mechanism. This vulnerability stems from the application's failure to properly validate and sanitize external entity references within XML documents during signature file preview operations. The flaw exists in how the software handles XML parsing, specifically when processing crafted signature files that contain malicious external entity declarations. When a user attempts to preview a specially constructed signature file through the file selection window, the application automatically processes the XML content without adequate security controls, triggering the XXE vulnerability regardless of whether the user subsequently clicks "Open". This behavior represents a significant security risk as it allows attackers to leverage the application's XML parser to make arbitrary network requests or access local system resources.
The technical implementation of this vulnerability involves the exploitation of XML parsing functionality that does not properly restrict external entity resolution. When an attacker crafts a malicious signature file containing XXE directives, the SmartSign application processes these entities during the preview phase, potentially enabling attackers to perform server-side request forgery attacks against internal network services or attempt local file inclusion attacks depending on the underlying XML parser configuration and system permissions. The vulnerability is particularly concerning because it operates entirely within the preview functionality, meaning that simply viewing a malicious file can trigger the exploit without requiring user interaction beyond the initial file selection. This design flaw aligns with CWE-611 weakness classification, which specifically addresses improper restriction of XML external entity references in XML parsers.
The operational impact of this vulnerability extends beyond simple information disclosure or service availability issues. Attackers could potentially leverage this XXE vulnerability to perform reconnaissance of internal network services that the SmartSign application server can access, including but not limited to database servers, application servers, or other sensitive backend systems. The ability to read local files represents a severe privilege escalation risk, as it could potentially expose configuration files, cryptographic keys, or other sensitive data stored on the system running the SmartSign application. This vulnerability falls under ATT&CK technique T1059.007 for XML External Entity Processing, and specifically addresses the broader category of server-side request forgery attacks that can bypass traditional network security controls by utilizing legitimate application functionality.
Organizations using proCertum SmartSign should immediately implement mitigations including updating to version 9.4.3.90 or later, which contains the necessary fixes for this XXE vulnerability. Additional protective measures include implementing strict XML parsing configurations that disable external entity resolution entirely, deploying network segmentation to limit access to internal services from the SmartSign application server, and conducting thorough code reviews of XML processing functions within the application. Security monitoring should be enhanced to detect unusual outbound network requests originating from the SmartSign service, particularly those attempting to access internal IP ranges or common service ports that might indicate exploitation attempts. The vulnerability demonstrates the importance of proper input validation and secure coding practices when handling external data sources, particularly in applications that process user-provided documents or signatures where preview functionality is provided without adequate security boundaries.