XXE Vulnerability in CRM-MKT-MPL-CA, SAP security note 2236654

SAP security note 2236654, “XXE Vulnerability in CRM-MKT-MPL-CA”. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data in the response, or access further network-located resources from the parsing system.

Solution

This SAP Note contains the JAR file with the latest version of the Campaign Automation Java applet. Follow the manual instructions below to implement the solution.

• Download the Attached File: download the sapca.jar file to your local system.
• Access BSP Application: open transaction SE80, choose ‘BSP Application’ from the dropdown list and open BSP Application CRM_UIU_CA2.
• Upload the JAR File: expand the ‘MIMEs’ folder, right-click on the file sapca.jar and select ‘Upload/Download’ → ‘Upload and Replace’, then in the file chooser dialog select the downloaded sapca.jar file and upload it to the system.

Reason and prerequisites

The issue is caused by a program error in CRM-MKT-MPL-CA due to incorrect use of an XML parser. By default, the parser opens external entities referenced within XML input, allowing malicious content to be parsed. This can lead to the disclosure of internal resources or a DoS attack.