CVE-2022-28213: SAP BusinessObjects XXE Vulnerability

CVE-2022-28213 Overview

CVE-2022-28213 is an XML External Entity (XXE) injection vulnerability affecting SAP BusinessObjects Business Intelligence Platform versions 420 and 430. When users access SOAP Web services, the platform fails to sufficiently validate XML documents accepted from untrusted sources. This improper validation allows attackers to craft malicious XML payloads that can result in arbitrary file retrieval from the server and enable successful Denial of Service (DoS) attacks.

Critical Impact

Attackers with low-privilege authenticated access can exploit this XXE vulnerability to exfiltrate sensitive files from the server and cause service disruption, potentially compromising confidential business intelligence data and disrupting critical reporting operations.

Affected Products

• SAP BusinessObjects Business Intelligence Platform version 420
• SAP BusinessObjects Business Intelligence Platform version 430

Discovery Timeline

• April 12, 2022 - CVE-2022-28213 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-28213

Vulnerability Analysis

This vulnerability stems from improper validation of XML schema (CWE-112) within the SOAP Web services component of SAP BusinessObjects Business Intelligence Platform. The vulnerable component accepts XML documents from authenticated users without properly restricting the processing of external entity references. This allows attackers to inject malicious Document Type Definitions (DTDs) that reference external resources.

When the XML parser processes these malicious documents, it resolves the external entities, potentially exposing sensitive server-side files or causing resource exhaustion. The attack can be executed remotely over the network with low attack complexity, requiring only basic authenticated access to the SOAP Web services interface.

Root Cause

The root cause of CVE-2022-28213 is the lack of proper XML document validation in the SOAP Web services handler. The XML parser is configured to process external entity declarations without appropriate restrictions, violating secure coding practices for XML processing. This misconfiguration allows the parser to resolve external entities that reference local file system paths or network resources, enabling both information disclosure and denial of service attacks.

Attack Vector

The attack exploits the network-accessible SOAP Web services interface in SAP BusinessObjects Business Intelligence Platform. An authenticated attacker can submit specially crafted XML requests containing malicious external entity declarations. When processed by the vulnerable XML parser, these entities can:

1. Reference local server files using file:// protocol handlers, leading to arbitrary file disclosure
2. Trigger requests to internal network resources, potentially enabling Server-Side Request Forgery (SSRF)
3. Cause denial of service through recursive entity expansion (billion laughs attack) or by referencing non-existent or slow-responding external resources

The vulnerability requires low-privilege authenticated access but no user interaction, making it exploitable in automated attack scenarios once initial access is obtained.

Detection Methods for CVE-2022-28213

Indicators of Compromise

• Unusual SOAP requests to the BusinessObjects web services containing XML external entity declarations
• Log entries showing file access attempts to sensitive system paths such as /etc/passwd or Windows system files
• Increased server resource consumption during XML document processing
• Error messages referencing external entity resolution failures or DTD processing issues

Detection Strategies

• Monitor SOAP Web service endpoints for XML payloads containing <!DOCTYPE declarations with ENTITY references
• Implement Web Application Firewall (WAF) rules to detect and block XXE attack patterns in incoming requests
• Review application and web server logs for anomalous file access patterns originating from the BusinessObjects application
• Deploy network monitoring to detect unexpected outbound connections initiated by the application server

Monitoring Recommendations

• Enable verbose logging on the SAP BusinessObjects SOAP Web services to capture full request payloads for forensic analysis
• Configure alerts for high-volume or malformed SOAP requests targeting BusinessObjects endpoints
• Implement file integrity monitoring on the BusinessObjects server to detect unauthorized file access attempts
• Monitor for unusual network traffic patterns from the application server that may indicate SSRF attempts

How to Mitigate CVE-2022-28213

Immediate Actions Required

• Apply SAP Security Note #3055044 immediately to all affected SAP BusinessObjects Business Intelligence Platform installations
• Restrict network access to SOAP Web services endpoints using firewall rules to limit exposure to trusted networks only
• Review and validate all user accounts with access to SOAP Web services, removing unnecessary privileges
• Enable additional logging on BusinessObjects servers to monitor for exploitation attempts

Patch Information

SAP has released Security Note #3055044 to address this vulnerability. The patch implements proper XML document validation and disables external entity processing in the SOAP Web services component. Administrators should review the SAP Security Documentation for detailed guidance on applying the fix. Additional technical details about the vulnerability are available via the Packet Storm Security advisory.

Workarounds

• Implement network-level restrictions to limit SOAP Web services access to trusted IP addresses only
• Deploy a Web Application Firewall with XXE detection rules in front of the BusinessObjects platform
• Disable SOAP Web services entirely if not required for business operations until patching is complete
• Configure XML parsers at the application server level to disable DTD processing and external entity resolution where possible

# Example WAF rule to block XXE patterns (ModSecurity format)
# Add to your WAF configuration to detect common XXE attack patterns
SecRule REQUEST_BODY "@rx <!ENTITY[^>]*SYSTEM" \
    "id:1001,phase:2,deny,status:403,msg:'XXE Attack Detected - External Entity'"