SAP security note 2492658, "Missing XML Validation vulnerability in SAP NetWeaver Java Workflow (JWF)", is a note released on October 23, 2017. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP NetWeaver Java Workflow (JWF) does not sufficiently validate an XML document accepted from an untrusted source. This vulnerability can lead to arbitrary file retrieval from the server and denial-of-service conditions in successful exploits.
Solution
Configure the XML parser to disallow external entities in incoming XML documents. Implement the Support Packages and Patches referenced in this SAP Note to address the vulnerability.
This security note has been re-released to include corrections for JAVA WORKFLOW 7.50 SP009.
CVSS
Score 6.9 Vector: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:H
Full note on SAP: SAP Support Launchpad note 2492658
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].