Overview
Akamai CloudTest is a performance and load testing platform. Its SOAP RepositoryService endpoint under /concerto/ parses XML with external entity processing left on.
An unauthenticated attacker posts a request with a malicious entity and reads files from the server. XBOW's published chain uses an external DTD and error-based extraction to pull file contents back through parser errors. Akamai disabled DTD processing in release 60 2025.06.02 (build 12988) and rolled the fix out across all CloudTest instances. CrowdSec has tracked exploitation attempts in the wild since July 2025.
Affected products
- Akamai CloudTest before release 60 2025.06.02 (build 12988)
Disclosure timeline
- 02 Jun 2025
- Akamai ships CloudTest release 60 2025.06.02 (12988) with DTD processing disabled
- 06 Jun 2025
- CVE-2025-49493 reserved
- 30 Jun 2025
- CVE published; XBOW write-up released
- 16 Jul 2025
- CrowdSec begins tracking exploitation attempts in the wild