SAP security note 2085214, "Untrusted XML input parsing possible in SAP Environmental Compliance 3.0". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability in SAP Environmental Compliance 3.0 allows malicious users to modify XML-based requests to include harmful XML content. This can lead to:
- Denial of Service (DoS)
- Information Disclosure
- Unauthorized Access to network resources
Solution
- Implement the solution: apply the downloaded solution to your SAP system.
- Apply dependent patches: ensure all dependent patches are downloaded and applied as outlined in SAP Note 1974464. Patches for Env.Compl. Centr. Services 3.0 require a server restart to become fully active.
Reason and prerequisites
The issue stems from incorrect usage of an XML parser that, by default, opens external entities within XML inputs. This enables the parsing of malicious content that can reference internal resources, leading to potential exploitation.
Side effects
- Error when opening reporting dataSource of the type "Business Object"
- The filters in the report wizard are not complete
References
- SAP Environmental Compliance 3.0 SP20: Corrections contained
- SAP Environmental Compliance 3.0 SP19: Corrections contained
- SAP Environmental Compliance 3.0 SP18: Contained corrections
Affected components
- TDAG_ECS_SERVICES
- TDAG_ECS_MODULES
- TDAG_XEM_MODULES
Full note on SAP: SAP Support Launchpad note 2085214
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
