Untrusted XML input parsing possible in BC-TWB-TST-ECA, SAP security note 2016638

SAP security note 2016638, “Untrusted XML input parsing possible in BC-TWB-TST-ECA”. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can modify an XML-based request to include malicious XML content that is then parsed locally.

This could allow a malicious user to perform a denial of service (DoS) on the parsing system, or disclose local data that is then returned in the response to the malicious request, or access further network-located resources that are accessible from the parsing system.

Solution

Apply the corrections contained in this note or upgrade to the following SPs:

• SAP_BASIS 7.40: SP08
• SAP_BASIS 7.31: SP13
• SAP_BASIS 7.30: SP12
• SAP_BASIS 7.11: SP14
• SAP_BASIS 7.10: SP19

Reason and prerequisites

The problem is caused by a program error in BC-TWB-TST-ECA due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed.

This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 5.5 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:P