Close

HAVE QUESTIONS?

A partner account manager can help. Contact us today.

[ERPSCAN-15-014] SAP Mobile Platform 3 – XXE Vulnerability in Add Repository

Application: SAP Mobile Platform 3
Vendor URL: http://www.sap.com
Bugs: XML eXternal Entity
Reported: 13.03.2015
Vendor response: 13.03.2015
Date of Public Advisory: 15.06.2015
Reference: SAP Security Note 2159601
Authors: Vahagn Vardanyan (ERPScan)

VULNERABILITY INFORMATION
Class: XML External Entity [CWE-611]
Impact: information disclosure, denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2015-5068
CVSS Information
CVSS Base Score: 5.5 / 10
CVSS Base Vector:

AV : Access Vector (Related exploit range) Network (N)
AC : Access Complexity (Required attack complexity) Low (L)
Au : Authentication (Level of authentication needed to exploit) Single (S)
C : Impact to Confidentiality Partial (P)
I : Impact to Integrity None (N)
A : Impact to Availability Partial (P)

BUSINESS RISK
The attacker can read an arbitrary file on the server by sending a correct XML request with a crafted DTD to read the reply from the service.
The attacker can perform a DoS attack (for example, an XML Entity Expansion attack).
An SMB Relay attack is a type of Man-in-the-Middle attack where the attacker asks the victim to authenticate into a machine controlled by the attacker, then relays the credentials to the target. The attacker forwards the authentication information both ways, giving them access.

DESCRIPTION
1) An attacker can read an arbitrary file on a server by sending a correct XML request with a crafted DTD and reading the response from the service.
2) An attacker can perform a DoS attack (for example, XML Entity Expansion).
3) An SMB Relay attack is a type of Man-in-the-Middle attack where the attacker asks the victim to authenticate into a machine controlled by the attacker, then relays the credentials to the target. The attacker forwards the authentication information both ways and gets access.

VULNERABLE PACKAGES
SAP NetWeaver AS Java 7.4
Other versions are probably affected too, but they were not checked.

SOLUTIONS AND WORKAROUNDS
To correct this vulnerability, install SAP Security Note 2159601.

TECHNICAL DESCRIPTION
SAP XML parser validates all incoming XML requests with a user-specified DTD. The vulnerability is presented in the field for adding a new repository. When an administrator adds the URL for a new repository and saves, SAP Mobile Platform searches for these files in remote URL:
- remote_URL\content.xml
- remote_URL\artifacts.xml
The attacker can change content.xml or artifacts.xml and add malicious code.