External risk intelligence

Anheng Mingyu Audit System XML-RPC SSRF Leads to Account Creation

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2023-7325

The product is an operation and maintenance audit and risk control system, which functions as a bastion host or gateway for infrastructure management. Such systems are typically deployed as edge services or management portals to facilitate remote access for administrators and are commonly reachable from the network, making public-facing or internet-adjacent deployment a standard pattern.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in an operation and maintenance audit and risk control system that could allow an attacker to create new user accounts and potentially take over the system. The vulnerability, identified as server-side request forgery, stems from how the system handles specially crafted XML-RPC requests. Attackers can exploit this to execute administrative functions through internal communication channels, bypassing normal security controls.

System flaw allows unauthorized account creation.
High-impact target for unauthorized system access.
Confirm relevance and assess exposure of this system.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted XML-RPC requests to the system's xmlrpc.sock handler. This allows them to trick the server into interacting with internal RPC endpoints. By doing so, an attacker can execute privileged XML-RPC methods that are normally inaccessible, leading to the creation of new user accounts and potentially full control over the system.

Accessible via the network.
Triggered by sending malicious XML-RPC requests.
Allows arbitrary user account creation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to send specially crafted requests to the Anheng Mingyu Operation and Maintenance Audit and Risk Control System. When supported by the advisory's configuration, these requests could trick the system into interacting with its own internal RPC endpoints. This could lead to the creation of arbitrary user accounts, potentially giving an attacker control over the bastion host.

Arbitrary user accounts on system.
Attacker sends crafted XML-RPC requests.
Bastion host takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Anheng Mingyu Operation and Maintenance Audit and Risk Control System, often deployed as a bastion host or management portal, is susceptible to a critical Server-Side Request Forgery vulnerability. Attackers can exploit this to perform privileged actions and potentially gain full control of the system. The first practical step involves identifying all instances of this system, confirming their network reachability and business criticality, and locating the accountable owner. Subsequently, a remediation plan should be developed based on the identified risk.

Ownership: Infrastructure or security operations teams.
Verify: System reachability and business criticality.
Action: Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Anheng Mingyu Operation and Maintenance Audit and Risk Control System?

It is a specialized security platform designed to manage and monitor infrastructure access. Acting as a bastion host or gateway, it provides administrators with a centralized portal to oversee internal systems. Because it controls sensitive entry points to an organization's network, its security is vital for maintaining administrative integrity and preventing unauthorized access to managed infrastructure.

What does Server-Side Request Forgery mean for CVE-2023-7325?

This vulnerability, classified as CWE-918 and CWE-306, allows an attacker to manipulate the system into making unintended network requests. In this case, the system can be tricked into interacting with its own internal communication channels, specifically its unix socket RPC endpoints. This bypasses normal authentication, effectively allowing a remote sender to command the server to execute high-privilege functions as if they were a trusted local process.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted XML-RPC requests to the system's xmlrpc.sock handler. The vulnerability exists because the software fails to properly validate these inputs, allowing the requests to be forwarded to internal RPC endpoints. Simply interacting with the system's standard web interface without these specific, malicious XML-RPC patterns does not initiate the exploitation process.

Why is this system considered a critical target?

Halo Surface Signal indicates that this software is frequently deployed as a gateway or edge service to facilitate remote management. These configurations often place the system in internet-facing or internet-adjacent network segments. Since the system acts as a central point of control, gaining unauthorized administrative access here could grant an attacker extensive control over the infrastructure the system is designed to protect.

What steps should I take if I run this technology?

Start by identifying all instances of the Anheng Mingyu system within your environment. Once you have a complete inventory, verify the network reachability of each instance to determine if they are exposed to untrusted networks. Identify the business owners for these systems, assess their criticality, and coordinate with them to develop a remediation plan to address the vulnerability and secure the administrative interfaces.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.