Untrusted XML input parsing possible in Pipeline Service, SAP security note 1838451

SAP security note 1838451, “Untrusted XML input parsing possible in Pipeline Service”, is a program error note released on 13.08.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.

Solution

A.) For more information about the affected releases, see the “SP Patch Level” section of this SAP note. For more information about the SP Stack schedule and updates, visit the SP Stacks maintenance schedule.

B.) Possible workaround before the release of the mentioned deliveries: there is no workaround possible.

Important: before applying this note, apply SAP note 1835125.

Reason and prerequisites

The problem is caused by a program error in Pipeline Service due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request or used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N

References

• 1841791 – KMC in SAP NetWeaver 7.0 SP29
• 1835125 – Untrusted XML input parsing possible in sapxmltoolkit

Affected components

• KMC-BC 7.00 – 7.02, 7.30, 7.31, 7.40
• EP-CM 6.0_640