XML External Entity vulnerability in SAP XML Parser, SAP security note 2093966

SAP security note 2093966, "XML External Entity vulnerability in SAP XML Parser". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data that is then returned in the response to the malicious request, or access further network-located resources that are accessible from the parsing system.

Solution

Under the "Support Packages & Patches" tab within this note, you can check for the appropriate Support Package (SP) and Patch levels that fix this issue.

Reason and prerequisites

The issue is caused by a program error in ‘ValidationComponent’ due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. This malicious content can reference internal resources, such as files, which can be disclosed in the response to the request or used to perform a denial of service attack on the parsing system, rendering application content temporarily unavailable.

CVSS

Score 5.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

References

• Central Note for Portal Platform in SAP NW7.1 SP20
• Central Note for Portal Platform in SAP NW7.1 EhP1 SP15
• Central Note for NetWeaver 7.40 SP11 EP / EPC
• Central Note for NetWeaver 7.30 SP13 EP / EPC

Affected components

• EP-ADMIN 7.10 – 7.11
• EP-ADMIN 7.20
• EP-ADMIN 7.30
• EP-ADMIN 7.31
• EP-ADMIN 7.40