SAP Security Note
Medium priority
SAP security note 1772370, "Untrusted XML input parsing possible in KM UI", is a program error note released on 04.06.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, or access further network-located resources that are accessible from the parsing system.
Solution
For more information about the affected releases, see the SP Patch Level tab page of this SAP note.
Reason and prerequisites
The problem is caused by a program error in KM UI due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal or external resources, such as files.
CVSS
Score 6.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:P
Affected components
- EPBC2: 7.00 to 7.02
- KMC-BC: 7.30 to 7.30, 7.31 to 7.31
- EP-CM: 6.0_640 to 6.0_640
Full note on SAP: SAP Support Launchpad note 1772370
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
