Untrusted XML input parsing possible in XI Adapter Framework, SAP security note 1723641

SAP security note 1723641, “Untrusted XML input parsing possible in XI Adapter Framework”, is a program error note released on July 10, 2012. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.

Solution

Apply the corresponding patch for your Support Package (SP) version. Refer to the "SP Patch Level" information in this note. For guidance on locating the archives on the SAP Service Marketplace, see SAP Note 952402.

Reason and prerequisites

The issue is caused by a program error in the XI Adapter Framework due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. This malicious content can reference internal resources, such as files, potentially disclosing them in responses or enabling DoS attacks on the parsing system, making application content temporarily unavailable.

CVSS

Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N