Ftk Imager
Monthly
XML External Entity (XXE) injection in Exterro FTK Imager before 8.3 allows an attacker to read arbitrary files from a forensic examiner's workstation by embedding malicious entity references and XSLT scripts within a crafted UFDR evidence archive. When an examiner previews the weaponized archive, the XML parser resolves file:// URIs and executes msxsl:script within an attacker-controlled stylesheet, exfiltrating file contents to an external endpoint via a generated image URL. The attack is particularly dangerous in forensic workflows because examiners routinely open submitted evidence archives, making file delivery a plausible social-engineering vector. No public exploit or CISA KEV listing has been identified; vendor-released patch version 8.3 is available.
XML External Entity (XXE) injection in Exterro FTK Imager before 8.3 allows an attacker to read arbitrary files from a forensic examiner's workstation by embedding malicious entity references and XSLT scripts within a crafted UFDR evidence archive. When an examiner previews the weaponized archive, the XML parser resolves file:// URIs and executes msxsl:script within an attacker-controlled stylesheet, exfiltrating file contents to an external endpoint via a generated image URL. The attack is particularly dangerous in forensic workflows because examiners routinely open submitted evidence archives, making file delivery a plausible social-engineering vector. No public exploit or CISA KEV listing has been identified; vendor-released patch version 8.3 is available.