Untrusted XML input parsing possible in XI, SAP security note 1707494

SAP security note 1707494, "Untrusted XML Input Parsing Possible in XI". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This vulnerability could allow an attacker to perform a denial of service (DoS) on the parsing system, disclose local data in the response to the malicious request, or access further network-located resources accessible from the parsing system.

Solution

Apply the appropriate patch as detailed in the Download for SNOTE or obtain the PDF Version.

Reason and prerequisites

The issue is caused by a program error in XI due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. This malicious content can reference internal resources, such as files, which can be disclosed in the response or used to perform a DoS attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N

References

Affected components

• Basis Components > NetWeaver Process Integration (PI) > Connectivity > SOAP Adapter (BC-XI-CON-SOP)