SAP Security Note
High priority
SAP security note 1972093, "Untrusted XML input parsing possible in BI4", is a program error note released on 11.11.2014. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data that is then returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.
Solution
The issue is resolved in the following releases:
- BI 4.0 SP08 Patch 9 and above
- BI 4.0 SP09 Patch 6 and above
- BI 4.0 SP10 Patch 1 and above
- BI 4.1 SP02 Patch 9 and above
- BI 4.1 SP03 Patch 4 and above
- BI 4.1 SP04 Patch 2 and above
You can download the patch for SNOTE or view the PDF version.
Reason and prerequisites
The issue is caused by a program error due to the incorrect use of an XML parser. Insufficient input filtering can lead to malicious content being parsed, which can reference internal resources such as files. These internal resources can be disclosed in responses or used to perform DoS attacks on the parsing system, rendering application content temporarily unavailable.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1972093
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
