SAP Security Note
High priority
SAP security note 2410082, "Missing XML Validation vulnerability in Web Dynpro Flash Island", is a program error note released on 11.04.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Web Dynpro Flash Islands do not sufficiently validate an XML document accepted from an untrusted source. This vulnerability can lead to:
- Arbitrary file retrieval from the server
- Denial-of-Service (DoS) conditions in successful exploits
Solution
- Secure Configuration: The XML parser is now configured securely to disallow external entities in incoming XML documents.
- Apply Support Packages and Patches: Implement the Support Packages and Patches referenced by this SAP Note.
Reason and prerequisites
The XML parser configured in the Flex classes does not prevent or limit the resolution of external entities, exposing the parser to an XML External Entities (XXE) attack.
CVSS
Score 7.5 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Affected components
- WEB DYNPRO FLEX CLIENT 7.20 to 7.50
Full note on SAP: SAP Support Launchpad note 2410082
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
