SAP Security Note
High priority
SAP security note 1684632, "Potential Information Disclosure in XML Encrypted SOAP Messages", is a program error note released on August 14, 2012. Below are the symptom, CVSS score, SAP recommended solution and the affected software components.
Description
Symptom
SAP Note 1684632 addresses a potential information disclosure vulnerability in XML Encrypted SOAP messages sent to NetWeaver Java (NW Java). An attacker can exploit this vulnerability to discover sensitive information related to XML Encrypted SOAP messages, which could facilitate more targeted attacks.
Solution
To mitigate this issue, apply the latest hotfix if you are using XML Encryption. Alternatively, you can reconfigure the affected web services to use SSL for transport protection instead of XML Encryption. Additionally, you can adjust the cache size for blacklisted keys and data for the standard CBC attack system property com.sap.xml.security.cbcprotection.size. The default value is 100.
CVSS
Score 4.3 Vector: AV:N/AC:M/AU:N/C:P/I:N/A:N
Affected components
- ENGINEAPI: 7.10 to 7.11+, 7.20 to 7.20+, 7.30 to 7.30+, 7.31 to 7.31+
Full note on SAP: SAP Support Launchpad note 1684632
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].