CVE-2015-6662

Vulnerability

An XML External Entity (XXE) vulnerability exists in SAP NetWeaver Portal 7.4, as described in SAP Security Note 2168485 [1]. The flaw occurs when the portal processes crafted XML data containing external entity declarations, enabling an attacker to read arbitrary server files or launch denial of service attacks through entity expansion. The vulnerability is officially designated as CWE-611 and affects SAP NetWeaver 7.4; other versions may also be impacted but were not tested [1].

Exploitation

An attacker must have network access to the vulnerable SAP NetWeaver Portal and be authenticated with a single user account (CVSS vector indicates Authentication: Single) [1]. The attacker sends a specially crafted XML request that includes a malicious Document Type Definition (DTD) referencing external entities. The portal processes the DTD and resolves the external entity, either returning the contents of a local file in the response or performing a denial of service via entity expansion [1]. Exploitation is remotely exploitable and does not require local access [1].

Impact

Successful exploitation leads to information disclosure (arbitrary file read on the server) and potential denial of service [1]. The CVSSv2 base score is 4.9 (Medium), with partial impact to confidentiality and availability, and no impact to integrity [1]. Additional unspecified impacts may include SMB relay attacks, where the server is tricked into authenticating to an attacker-controlled machine via the crafted XML [1].

Mitigation

SAP has released Security Note 2168485 to address this vulnerability [1]. Administrators should apply the corresponding patch to SAP NetWeaver 7.4 as soon as possible. No workarounds are provided in the available references; installation of the security note is the recommended course of action [1].