Security XML generation encoded for OLTP data generation, SAP security note 1493685

SAP security note 1493685, “XML Generation Vulnerability in OLTP Data Generation”, is a program error note. Below is the security information published by SAP for this note.

Description

This security note addresses a vulnerability in the XML generation process within the OLTP (Online Transaction Processing) data provider component. The issue allows external parties to exploit the XML generation code, potentially leading to malicious code injection.

Symptom:

• When a user runs the OLTP application and loads a report, a request is sent to the backend data provider component.
• The data provider retrieves data from BW, renders it into an XML structure, and sends it back to the application front.
• The existing XML generation code is susceptible to exploitation if the data is not properly sanitized.

Solution:

• Apply SAP Note 1493685.
• This update ensures that the data returned from BW is properly escaped before being converted into XML format and sent in the HTTP response header.
• Post-application, there should be no visible differences in the reports rendered by the OLTP component.
• The data content remains unchanged, but malicious code injection is prevented by escaping the XML data.

References

• 1468577 – SAP CRM 2007 – SP-Stack 08