PT-2016-1706 · Sap · Sap Netweaver As Java

Vahagn Vardanyan · Published 2016-04-14 · Updated 2018-12-10 · CVE-2016-4014

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver JAVA AS 7.4

Description The issue is related to an XML external entity (XXE) vulnerability in the UDDI component, which is caused by incorrect restriction of XML links to external objects. This can be exploited by a remote attacker to cause a denial of service (system hang) by sending a crafted XML request. The API endpoint /uddi/api/replication is specifically vulnerable to this type of attack.

Recommendations For SAP NetWeaver JAVA AS 7.4, consider disabling the UDDI component until a patch is available to prevent exploitation of the XXE vulnerability. Restrict access to the /uddi/api/replication API endpoint to minimize the risk of a denial of service attack.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2016-01032

CVE-2016-4014

Affected Products

Sap Netweaver As Java

References · 10

• 🔥 https://github.com/murataydemir/CVE-2016-4014 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Jul/45 · Exploit
• 🔥 http://packetstormsecurity.com/files/137919/SAP-NetWeaver-AS-JAVA-7.4-XXE-Injection.html · Exploit
• https://bdu.fstec.ru/vul/2016-01032 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4014 · Security Note
• https://erpscan.io/advisories/erpscan-16-020-sap-netweaver-java-uddi-component-xxe-vulnerability · Note
• https://erpscan.io/press-center/blog/dos-vulnerabilities-on-the-rise-sap-security-notes-april-2016 · Note
• https://erpscan.com/press-center/blog/dos-vulnerabilities-on-the-rise-sap-security-notes-april-2016 · Note
• https://erpscan.com/advisories/erpscan-16-020-sap-netweaver-java-uddi-component-xxe-vulnerability · Note