CVE-2019-0284 XML External Entity vulnerability in SAP HANA sldreg, SAP security note 2772376

SAP security note 2772376, "[CVE-2019-0284] XML External Entity vulnerability in SAP HANA sldreg". Below are the symptom and the SAP recommended solution.

Description

Symptom

SLD Registration in SAP HANA does not sufficiently validate an XML document accepted from an untrusted source.

Some well-known impacts of Missing XML Validation vulnerability are:

• Arbitrary file retrieval from the server
• Denial-of-service conditions in successful exploits

Solution

SLDREG has been updated with the following SAP HANA revisions. Update to these or later versions:

• 122.24 for SAP HANA 1.00 SPS12
• 24.09 for SAP HANA 2.0, SPS02
• 37 for SAP HANA 2.0, SPS03

SAP HANA 2.0 SPS04 is not affected.

Reason and prerequisites

SLD Registration (SLDREG) is used by SAP HANA to register the SAP HANA system to the System Landscape Directory. An attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE). This can cause SLDREG to, for example, continuously loop, read arbitrary files, and even send local files.

Prerequisite: An authenticated attacker must have local access to the SAP HANA server. SLDREG can then be executed, and arbitrary files/resources can be processed within the authorization scope of the authenticated attacker.

CVSS

Score 5.1 Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H