Untrusted XML input parsing possible in SAP Environmental Compliance 3.0, SAP security note 2085214

SAP security note 2085214, "Untrusted XML input parsing possible in SAP Environmental Compliance 3.0". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A vulnerability in SAP Environmental Compliance 3.0 allows malicious users to modify XML-based requests to include harmful XML content. This can lead to:

• Denial of Service (DoS)
• Information Disclosure
• Unauthorized Access to network resources

Solution

• Implement the solution: apply the downloaded solution to your SAP system.
• Apply dependent patches: ensure all dependent patches are downloaded and applied as outlined in SAP Note 1974464. Patches for Env.Compl. Centr. Services 3.0 require a server restart to become fully active.

Reason and prerequisites

The issue stems from incorrect usage of an XML parser that, by default, opens external entities within XML inputs. This enables the parsing of malicious content that can reference internal resources, leading to potential exploitation.

Side effects

• Error when opening reporting dataSource of the type "Business Object"
• The filters in the report wizard are not complete

References

• SAP Environmental Compliance 3.0 SP20: Corrections contained
• SAP Environmental Compliance 3.0 SP19: Corrections contained
• SAP Environmental Compliance 3.0 SP18: Contained corrections

Affected components

• TDAG_ECS_SERVICES
• TDAG_ECS_MODULES
• TDAG_XEM_MODULES