SAP security note 2892570, “Missing XML Validation vulnerability in ABAP Development Tools”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Security Note 2892570 addresses a critical vulnerability in ABAP Development Tools that affects versions up to and including 3.8.2. ABAP Development Tools do not sufficiently validate an XML document accepted from an untrusted source.
Exploiting this vulnerability can lead to:
- Arbitrary files retrieval from the server.
- Denial-of-service conditions.
Solution
Upgrade to ABAP Development Tools version 3.8.3 or later. The issue is resolved by using a custom org.xml.sax.ContentHandler that validates the XML input, allowing only known safe classes to be deserialized. This change effectively prevents the execution of malicious code through unknown class names.
Reason and prerequisites
The vulnerability arises from the java.beans.XMLDecoder used to deserialize formatter settings stored as serialized Java objects. A crafted formatter setting can allow arbitrary code execution on the frontend machine with the privileges of the logged-on user. This requires that an attacker can place a crafted formatter configuration in the backend system or inject it during transfer between the backend system and the ABAP Development Tools client.
CVSS
Score 5.9 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected components
- SAP_BASIS_AIE from version 3 to 3
Full note on SAP: SAP Support Launchpad note 2892570
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].