SAP Security Note
High priority
SAP security note 2569748, "XML External Entity vulnerability in Crystal Reports for Enterprise", is a program error note released on 14.08.2018. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A user can experience errors/hangs when interacting with a Crystal Reports for Enterprise report that embeds an Xcelsius SWF object.
Solution
The solution has the XML parser properly configured to no longer be vulnerable to such attacks.
This issue is fixed in the patches listed in the "Support Packages & Patches" section below. The "Support Packages & Patches" section will be populated with the relevant patch levels once they are released. For Business Intelligence Platform maintenance schedule and strategy see the Knowledge Base Article 2144559 in the References section.
Reason and prerequisites
The XML content inside the SWF would need to be crafted in such a way that it forms the XML External Entity attack.
References
Affected components
- ENTERPRISE 410 to 410+
- ENTERPRISE 420 to 420+
Full note on SAP: SAP Support Launchpad note 2569748
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
