N-able N-Central Authentication Bypass and XXE Scanner

Classification basis

The module is classified as a scanner because its primary purpose, as stated in its name ('Scanner'), description ('This module scans for vulnerable N-able N-Central instances'), and type ('auxiliary'), is to detect and report vulnerabilities. Although it performs actions that technically exploit the vulnerabilities (obtaining a session, reading a file via XXE), these actions serve the scanning goal of validating exposure and are not used for further post-exploitation impact. The module includes Msf::Auxiliary::Scanner and reports vulnerabilities, consistent with a scanner role.

Requirements

• Target must be running a vulnerable version of N-able N-Central (< 2025.4.0.9).modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:35
• Attacker must be able to reach the target's HTTP service and run a local HTTP/HTTPS server for DTD delivery.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:78-86

Observed behavior

• Sends a sessionHello SOAP request to /dms/services/ServerUI with appliance IDs from a configurable range to obtain an unauthenticated session ID.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:126-149
• If a session is obtained, writes a base64-encoded XXE payload to a log file via an applianceLogSubmit SOAP request to /dms/services/ServerMMS.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:233-248
• Triggers the XXE by calling importServiceTemplateFromFile on the written payload file, causing the target to fetch an attacker-hosted DTD and exfiltrate file contents via an error-based technique.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:250-260modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:338-350
• Reports vulnerabilities (CVE-2025-9316 and CVE-2025-11700) and stores exfiltrated file content as loot.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:113-120modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:194-203

Observables

Network Behavior

Sends SOAP requests to /dms/services/ServerUI and /dms/services/ServerMMSUsed to test for CVE-2025-9316 authentication bypass and to write/trigger XXE payload for CVE-2025-11700.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:136modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:242modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:259

Network Behavior

Starts an HTTP/HTTPS server to serve a malicious DTD for out-of-band XXERequired for the error-based XXE technique to exfiltrate file contents from the target.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:78-86modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:338-349

File Operation

Writes XXE payload to target via applianceLogSubmit SOAP callPart of the exploit chain for CVE-2025-11700; the payload is base64-encoded and written to a log file on the target.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:233-248

Data Exfiltration

Reads arbitrary files from target via XXE and stores them as lootThe module reads a user-specified file (default /etc/passwd) and stores it using store_loot, which is standard Metasploit behavior for captured data.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:194