SAP security note 1725390, "Untrusted XML input parsing possible in GRMG". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data that is then returned in the response to the malicious request, or access further network-located resources that are accessible from the parsing system.
Solution
Please use the recent version of the support package. You will find the corresponding patch number of the package in the SP Patch level section of this note. The fix is in the included patched component. You can use SDM to deploy only the component grmg.SDA.
The instance restart will be necessary to restore the GRMG monitoring.
Reason and prerequisites
The problem is caused by a program error in Generic Request and Message Generator (GRMG) due to the incorrect use of an XML parser.
By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.
CVSS
Score 5.0 Vector: AV:N/AC:L/AU:N/C:N/I:N/A:P
References
- SAP Note 1759165 – CCMS: Trace of GRMG core services in J2EE
- SAP Note 1395627 – Import a patch for WebDynproRuntime Java
Affected components
- LM-CORE 7.11
- LM-CORE 7.20
- LM-CORE 7.30
- LM-CORE 7.31
- SAP_JTECHS 6.40
- SAP_JTECHS 7.00 to 7.02
Full note on SAP: SAP Support Launchpad note 1725390
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
