SAP security note 1835125, “Untrusted XML input parsing possible in sapxmltoolkit”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data that is returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.
Solution
Update the SAP Java AS according to the note validity table.
Reason and prerequisites
The issue is caused by a program error in sapxmltoolkit due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, potentially allowing malicious content to be parsed. This malicious content can reference internal resources, such as files, which may be disclosed in the response or used to perform a denial of service attack, rendering application content temporarily unavailable.
CVSS
Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N
Full note on SAP: SAP Support Launchpad note 1835125
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
