High priority
SAP security note 2090851, “Untrusted XML input parsing possible in SLD”, is a program error note released on 21.05.2015. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can modify an XML-based request to include malicious XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.
Solution
Update your AS Java to a Support Package (SP) or release where the issue is fixed. Refer to the Support Package Patches section for details and available patches.
Reason and prerequisites
The problem is caused by a program error in SLD due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. This malicious content can reference internal resources, such as files, which can be disclosed in the response to the request or used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.
CVSS
Score 4.9 / 10 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:P
References
Referenced by
- 2168341 – Accessing SLD fails with error NoClassDefFoundError: com/sap/sld/api/util/XmlParserFactory
- 2236119 – Corrections for unified rendering up to SAP_BASIS 711/16 I (UR-Mimes)
- 2034461 – Central Note for SAP NetWeaver AS Java 7.31 SP14
- 2146188 – Central note for SAP NetWeaver 7.31 SP16 Application Server Java
Affected components
- LM-CORE: 7.10 to 7.40
- SAP_JTECHS: 6.40 to 7.02
- SAP_JTECHF: 7.00 to 7.02
- J2EE-FRMW: 7.10 to 7.40
Full note on SAP: SAP Support Launchpad note 2090851
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].