Rapid7 Vulnerability & Exploit Database

SAP Internet Graphics Server (IGS) XMLCHART XXE

Back to Search

SAP Internet Graphics Server (IGS) XMLCHART XXE

Disclosed
03/14/2018
Created
10/07/2020

Description

This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities within the XMLCHART page of SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag when submitting a POST request to the XMLCHART page to generate a new chart. Successful exploitation will allow unauthenticated remote attackers to read files from the server as the user from which the IGS service is started, which will typically be the SAP admin user. Alternatively attackers can also abuse the XXE vulnerability to conduct a denial of service attack against the vulnerable SAP IGS server.

Author(s)

  • Yvan Genuer
  • Vladimir Ivanov

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/admin/sap/sap_igs_xmlchart_xxe
msf auxiliary(sap_igs_xmlchart_xxe) > show actions
    ...actions...
msf auxiliary(sap_igs_xmlchart_xxe) > set ACTION < action-name >
msf auxiliary(sap_igs_xmlchart_xxe) > show options
    ...show and set options...
msf auxiliary(sap_igs_xmlchart_xxe) > run

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;