Untrusted XML input parsing possible in PMI, SAP security note 1721309

SAP security note 1721309, “Untrusted XML input parsing possible in PMI”, is a program error note released on 10.07.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, or disclose local data that is then returned in the response to the malicious request, or access further network-located resources that are accessible from the parsing system.

Solution

Please upgrade to the latest Support Package or deploy a patch with the appropriate patch level. The minimum patch level information is provided in the "Support Package Patches" section of this note.

Reason and prerequisites

The problem is caused by a program error in XI due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N