PT-2019-13775 · Sas · Sas Xml Mapper

Published 2019-11-14 · Updated 2019-11-22 · CVE-2019-14678

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAS XML Mapper version 9.45

Description The issue is an XML External Entity (XXE) vulnerability. This can be exploited by malicious attackers in various ways, including Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. The XMLV2 LIBNAME engine is also affected when the AUTOMAP option is used.

Recommendations For SAS XML Mapper version 9.45, consider disabling the AUTOMAP option in the XMLV2 LIBNAME engine as a temporary workaround to minimize the risk of exploitation. Restrict access to sensitive files and directories to prevent potential Local File Reading and Out Of Band File Exfiltration attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-14678

Affected Products

Sas Xml Mapper

References · 4

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper · Exploit
• http://support.sas.com/kb/64/719.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14678 · Security Note