PT-2021-17570 · Sap · Sap Netweaver As Java

Pablo Artuso · Published 2021-06-09 · Updated 2021-11-04 · CVE-2021-27635

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS for JAVA versions 7.20, 7.30, 7.31, 7.40, 7.50

Description The issue allows an attacker, authenticated as an administrator, to submit a specially crafted XML file due to missing XML validation. This enables the attacker to fully compromise confidentiality by reading any file on the filesystem or fully compromise availability by causing the system to crash. However, the attack cannot be used to change any data, so there is no compromise of integrity.

Recommendations For SAP NetWeaver AS for JAVA versions 7.20, 7.30, 7.31, 7.40, 7.50, consider implementing proper XML validation to prevent the submission of specially crafted XML files. As a temporary workaround, restrict access to the XML file submission feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-27635

Affected Products

Sap Netweaver As Java

References · 6

• http://packetstormsecurity.com/files/164592/SAP-JAVA-NetWeaver-System-Connections-XML-Injection.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-27635 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27635 · Vendor Advisory
• http://seclists.org/fulldisclosure/2021/Oct/28 · Patch
• https://launchpad.support.sap.com/#/notes/3053066 · Vendor Advisory