Security fix for SLM treating XXE vulnerability, SAP security note 1820894

SAP security note 1820894, "Security fix for SLM treating XXE vulnerability," is a note covering the symptom, SAP recommended solution, the reason and prerequisites, and the affected software components.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data that is returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.

Solution

Apply the appropriate patch for component SWLIFECYCL:

• NW 7.30 SP 10 or later
• NW 7.31 SP6 Patch 1
• NW 7.31 SP7 or later
• NW 7.40 SP3 or later

Reason and prerequisites

The issue is caused by a program error in SLM due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. This malicious content can reference internal resources, such as files, which can be disclosed in the response to the request or used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N

Affected components

• SWLIFECYCL 7.30 to 7.30
• SWLIFECYCL 7.31 to 7.31
• SWLIFECYCL 7.40 to 7.40