SAP security note 2729710, "[CVE-2019-0265] XML External Entity (XXE) vulnerability in SLD Registration of SAP NetWeaver and ABAP Platform". Below are the symptom and the SAP recommended solution.
Description
Symptom
SLD Registration of SAP NetWeaver (application server ABAP and application server Java) and ABAP Platform do not sufficiently validate an XML document accepted from an untrusted source. This vulnerability allows attackers to exploit XML External Entities (XXE) to retrieve arbitrary files from the server or cause denial-of-service conditions.
An attacker can call SLDREG with an XML file containing a reference to an XXE. This can lead to continuous loops, arbitrary file retrieval, and even sending local files to external entities.
Solution
The correction avoids processing all XML files that use XXE. XML files with XXE references will be considered invalid. To implement the solution:
- Apply the corresponding patch for SLDREG.EXE as mentioned under the SAP KERNEL Patch Level.
- Ensure that your system is updated to the appropriate support package levels provided below.
Reason and prerequisites
The vulnerability arises from insufficient validation of XML documents in the SLD Registration process. No specific prerequisites are required; any user with access to submit XML files can potentially exploit this vulnerability.
CVSS
Score 6.0 Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Full note on SAP: SAP Support Launchpad note 2729710
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].