MDX XML for Analysis – known security holes, SAP security note 1881391

SAP security note 1881391, "MDX: XML for Analysis – known security holes", was released on July 9, 2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP BW provides multiple interfaces for data access using Multidimensional Expressions (MDX):

• OLAP BAPI (Business Application Programming Interface)
• OLE DB for OLAP
• XML for Analysis (XMLA)

While most front-end tools utilize OLAP BAPIs, access via OLE DB for OLAP is less common, and XMLA usage is rare. Security vulnerabilities exist in the XMLA interface if the relevant security notes are not implemented, potentially allowing unauthorized access and various attacks.

Solution

• Apply Security Notes 1530454 and 1597066: These notes address and close the known security vulnerabilities.
• Deactivate XMLA Interface: If the XMLA interface is not in use, it is recommended to deactivate it to prevent potential attacks.
  • Service Path: /default_host/sap/bw/xml/soap/
  • Service Name: xmla
  • Transaction Code: SICF

Reason and prerequisites

When the XMLA interface is invoked, the system processes and parses XML documents, which can be exploited through:

• MDX Security Tag Injection
• XML External Entity (XXE) attacks
• XML Bombs
• XSLT Code Injection

These vulnerabilities may be exploited if the XMLA service is activated in the Internet Communication Framework (transaction SICF), even if no applications currently utilize this interface. Products that can interact with the XMLA interface include:

• Microsoft Reporting Services (see SAP Note 1868077)
• Oracle Business Intelligence Enterprise Edition

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N

References

• 1889488 – Briefing at Black Hat conference on July 31st, 2013
• 1868077 – MDX: Microsoft Reporting Services – problems with BW 7.30 and higher releases
• 1597066 – MDX: SOAP / XMLA interface and Document Type Definitions
• 1530454 – MDX: XML injection when an XMLA interface is used

Affected components

• SAP_BW: Versions 30A to 30B, 310, 350, 700 to 702, 711 to 730, 731, 740
• SAP_BW_VIRTUAL_COMP: Versions 701, 711