CVE-2016-6256 in Business One for Android
Summary
by MITRE
SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/01/2025
The vulnerability identified as CVE-2016-6256 represents a critical XML External Entity (XXE) flaw in SAP Business One for Android version 1.2.3. This security weakness resides within the mobile application's handling of SOAP requests processed through the B1iXcellerator framework, specifically targeting the endpoint path that includes the INB_WS_CALL_SYNC_XPT service. The XXE vulnerability occurs when the application fails to properly validate and sanitize XML input data, allowing malicious actors to inject external entity references that can be processed by the underlying XML parser. This flaw falls under the CWE-611 vulnerability category, which specifically addresses XXE attacks where external entities are improperly handled during XML processing operations.
The attack vector for this vulnerability involves sending specially crafted XML data to the vulnerable endpoint through a SOAP request structure. When the application processes these malformed requests, the XML parser attempts to resolve external entity references, potentially enabling attackers to access local files, perform server-side request forgery attacks, or conduct internal network reconnaissance. The targeted service path indicates this vulnerability affects the integration layer of SAP Business One, specifically the web service call synchronization functionality that facilitates communication between the mobile client and backend SAP systems. This presents a significant risk as the mobile application serves as an entry point for business users to access enterprise data and processes.
The operational impact of this vulnerability extends beyond simple data exposure, as it can enable attackers to escalate their privileges and potentially gain unauthorized access to sensitive business information stored within the SAP environment. The vulnerability affects organizations using SAP Business One mobile applications, creating potential risks for data integrity, confidentiality, and availability. Attackers could exploit this weakness to extract sensitive corporate data, disrupt business processes, or use the compromised mobile application as a foothold for further attacks against the broader SAP ecosystem. This vulnerability demonstrates the importance of proper input validation and secure coding practices when handling XML data in enterprise mobile applications, particularly those integrating with critical business systems.
Organizations should implement immediate mitigations including disabling external entity processing in XML parsers, implementing strict input validation controls, and restricting access to vulnerable endpoints through network segmentation and authentication controls. The vulnerability highlights the necessity of following security best practices such as those outlined in the OWASP Top Ten and NIST cybersecurity frameworks, particularly focusing on secure coding practices and input sanitization. SAP has released Security Note 2378065 to address this issue, recommending that organizations upgrade to patched versions of the SAP Business One mobile application and implement proper XML parsing security measures. Additionally, organizations should conduct comprehensive security assessments of their mobile application environments and implement monitoring solutions to detect anomalous XML processing activities that could indicate exploitation attempts.