XML External Entity vulnerability in SAP XML Parser, SAP security note 2098608

SAP security note 2098608, "XML External Entity vulnerability in SAP XML Parser", is a program error note released on 10.02.2015. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data that is then returned in the response to the malicious request, or access further network-located resources that are accessible from the parsing system.

Solution

Under the "Support Packages & Patches" tab within this note, you can check for the appropriate Service Pack (SP) and Patch levels that fix this issue.

Reason and prerequisites

The problem is caused by a program error in ‘ValidationComponent’ due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. This malicious content can reference internal resources, such as files, which can then be disclosed in the response or used to perform a DoS attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 5.5 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:P

References