Full Report
GrassMarlin leaks sensitive information, provided your targeting phishing skills are sharp enough The Cybersecurity and Infrastructure Security Agency (CISA) is warning anyone who uses GrassMarlin, a tool developed by the National Security Agency (NSA), about a new vulnerability that attackers can use to snoop on sensitive information.…
Analysis Summary
# Vulnerability: XML External Entity (XXE) in NSA GrassMarlin
## CVE Details
- **CVE ID:** CVE-2026-6807
- **CVSS Score:** 5.5 (Medium)
- **CWE:** CWE-611: Improper Restriction of XML External Entity Reference
## Affected Systems
- **Products:** GrassMarlin (NSA-developed Operational Technology networking tool)
- **Versions:** All versions (Note: The tool has been End-of-Life since 2017)
- **Configurations:** Systems using the version of Java bundled with the GrassMarlin installer are specifically vulnerable.
## Vulnerability Description
The flaw stems from insufficient hardening of the XML parsing process within GrassMarlin. The application uses XML files to save session data (nodes, edges, positioning, and metadata), which are bundled into a ZIP archive with a `.gm3` extension.
Because the XML parser does not properly restrict external entity references, an attacker can craft a malicious `.gm3` file. When an unsuspecting user opens this session file, the parser can be induced to perform Out-of-Band (OOB) exfiltration of arbitrary files from the host system to an external attacker-controlled server.
## Exploitation
- **Status:** PoC available (Developed by Rapid7/Anna Quinn)
- **Complexity:** Medium (Requires crafting a specific payload and bypassing Java version restrictions)
- **Attack Vector:** Local/Social Engineering (The primary vector is phishing; an attacker must convince a user to open a malicious session file).
## Impact
- **Confidentiality:** High (Allows for the exfiltration of arbitrary local files)
- **Integrity:** None
- **Availability:** Low (Some inputs may cause application errors/crashes during exfiltration)
## Remediation
### Patches
- **None:** GrassMarlin reached End-of-Life (EOL) in 2017. No official patches are expected from the NSA or CISA.
### Workarounds
- **Isolate Assets:** Ensure Industrial Control Systems (ICS) and SCADA devices are not accessible via the open internet.
- **Network Segmentation:** Isolate firewalled control networks from business networks.
- **Secure Access:** Use secure methods (e.g., VPN with MFA) if remote access to the environment is required.
- **File Validation:** Exercise extreme caution when opening GrassMarlin session files (`.gm3`) from untrusted or external sources.
## Detection
- **Indicators of Compromise:**
- Network traffic to unknown external hosts over ports typically used for DTD referencing or OOB data exfiltration.
- Presence of Base64 encoded strings in outbound network traffic formatted as multiple "message chunks."
- **Detection Methods:** Monitor for unusual file access patterns by the GrassMarlin process and inspect `.gm3` archives for malicious XML structures or external DTD references.
## References
- **CISA Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-26-118-01
- **PoC Repository:** hxxps[://]github[.]com/SecTestAnnaQuinn/Grassmarlin-CVE-2026-6807-XXE-POC/tree/main
- **Original Report:** Dragos (Grady DeRosa)