SAP Security Note
High priority
SAP security note 2254389, "XXE vulnerability in SAP UDDI", is a program error note released on 12.04.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP UDDI Server does not sufficiently validate an XML document accepted from an untrusted source.
Some well-known impacts of Missing XML Validation vulnerability are:
- Arbitrary file retrieval from the server
- Denial-of-service conditions in successful exploits
Solution
The XML parser is now configured securely so that it does not allow external entities as part of an incoming XML document.
Note: this correction is known to cause issue 2267139 (UDDI applications and services does not start) as a side effect.
Reason and prerequisites
An attacker can trigger an XML Entity Expansion or XML External Entity Injection. This causes the entire machine to become unresponsive until the process is terminated manually. An attacker can use this flaw to launch a denial-of-service (DoS) attack.
CVSS
Score 7.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
References
Full note on SAP: SAP Support Launchpad note 2254389
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].