SAP security note 2308217, "Missing XML Validation vulnerability in Web-Survey". Below are the symptom, SAP recommended solution, reason and prerequisites, the CVSS score, and references.
Description
Symptom
Web Survey does not sufficiently validate an XML document accepted from an untrusted source. This Missing XML Validation vulnerability can lead to:
- Arbitrary file retrieval from the server
- Denial-of-service conditions in successful exploits
Solution
The XML parser has been securely configured to prevent the allowance of external entities in incoming XML documents within Web Survey. Implement the attached correction instructions corresponding to your release to mitigate this vulnerability.
Reason and prerequisites
A program error allows the set of valid entities in Web Survey XML for Incoming Mail-Replies to be extended by defining new external entities. Unless configured otherwise, external entities can force the XML parser to access resources specified by URIs, exposing the application to XML External Entity (XXE) attacks. These attacks can be used to perform denial of service on the local system, gain unauthorized access to files on the local machine, scan remote machines, and perform denial of service on remote systems.
CVSS
Score 7.5 / 10 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Full note on SAP: SAP Support Launchpad note 2308217
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].