SAP security note 2168485, "XXE Vulnerability in Landscape System Configuration." Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, or disclose local data that is then returned in the response to the malicious request, or access further network-located resources that are accessible from the parsing system.
Solution
Refer to the Support Packages & Patches link to view the versions including the fix.
Reason and prerequisites
The problem is caused by a program error in EP-PIN-PSL due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.
CVSS
Score 4.9 / 10 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:P
References
This note refers to
Affected components
- EP-RUNTIME: Versions 7.30, 7.31, 7.40, 7.50
Full note on SAP: SAP Support Launchpad note 2168485
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
