SAP security note 2661740, "[CVE-2018-2477] XML External Entity (XXE) Vulnerability in SAP NetWeaver Knowledge Management XMLForms", was released on November 13, 2018. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP NetWeaver Knowledge Management XMLForms does not sufficiently validate XML documents from untrusted sources. This vulnerability allows attackers to retrieve arbitrary files from the server or cause denial-of-service (DoS) conditions.
Solution
- Update XML Parser Configuration: configure the XML parser to disallow external entities in incoming XML documents.
- Apply Support Packages and Patches: implement the support packages and patches referenced in SAP Note 2661740.
- For custom XML Forms projects: if your projects depend on external entities, update them to include your entities in a whitelist. Open the Config Tool, select Configuration Editor from the drop-down menu and locate the XMLHardener node, create a sub-node named “wcm.service.xmlforms”, then add external configuration for the XMLHardener with a whitelist of your entities, either manually or using the XML Hardener UI Tool as detailed in SAP Note 2261259.
CVSS
Score 6.5/10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- CVE-2018-2477
Affected components
- EP-KM-TLS-XFB (Enterprise Portal > Enterprise Portal – Knowledge Management and Collaboration > KM Tools > XF Builder)
Full note on SAP: SAP Support Launchpad note 2661740
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
