Untrusted XML Input parsing possible in iXML applications, SAP security note 1744122

SAP security note 1744122, “Untrusted XML Input parsing possible in iXML applications”, is a program error note released on 11.09.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can modify an XML-based request to include XML content which is then parsed locally. This could allow a malicious user to perform a denial of service on the parsing system, or disclose local data which is then returned in the response to the malicious request.

Solution

Implementing the two notes 1712860 and 1741441 provides the infrastructure for using the iXML DTD protection functions. Implementing both notes is a prerequisite for all future security notes related to applications using the iXML Parser or XSLT. In addition to that, they provide a bug fix for 1594475.

Reason and prerequisites

The problem is caused by an incorrectly configured XML parser used by an iXML application. The parser will open by default external entities referenced within an XML input which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as other XML files, which can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 0

References

Affected components

• SAP_BASIS: 640 to 640
• SAP_BASIS: 700 to 702
• SAP_BASIS: 710 to 730
• SAP_BASIS: 731 to 731