SAP security note 2253850, “XML External Entity vulnerability in RTMF”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data in the response, or access further network-located resources accessible from the parsing system.
Solution
Under the "Support Packages & Patches" tab within this note, check for the appropriate SP and Patch levels that address this issue.
Reason and prerequisites
The issue is caused by a program error in RTMF due to incorrect use of an XML parser. By default, the parser opens external entities referenced within XML input, allowing malicious content to be parsed. This can lead to the disclosure of internal resources or a denial of service attack on the parsing system, rendering application content temporarily unavailable.
CVSS
Score 6.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
This note refers to
Affected components
- EP-BASIS-API: Versions 7.10 to 7.50
- EPBC: Version 7.02
Full note on SAP: SAP Support Launchpad note 2253850
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
