Missing XML Validation vulnerability in SAP Netweaver Visual Composer, SAP security note 2347439

SAP security note 2347439, "Missing XML Validation vulnerability in SAP Netweaver Visual Composer", is a program error note released on January 10, 2017. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.

Visual Composer flex.broker does not sufficiently validate an XML document accepted from an untrusted source.

Impacts include:

• Arbitrary file retrieval from the server
• Denial-of-service conditions in successful exploits

Solution

This issue was resolved by adding a set of features to the DocumentBuildFactory object to prevent malicious code parsing.

Reason and prerequisites

The issue is caused by a program error in flex.broker due to incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. These internal resources can be disclosed in the response to the request or used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable. This requires running Visual Composer iViews created in 04s versions.

CVSS

Score 6.4 Vector: AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

References