CVE-2018-2392
published 2018-02-14CVE-2018-2392: Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the…
PriorityP178high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
40.59%
98.5th percentile
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | internet_graphics_server | — | — |
| sap | internet_graphics_server | — | — |
| sap | internet_graphics_server | — | — |
| sap | internet_graphics_server | — | — |
| sap | internet_graphics_server | — | — |
| sap_se | sap_internet_graphics_server | — | — |
| sap_se | sap_internet_graphics_server | — | — |
| sap_se | sap_internet_graphics_server | — | — |
| sap_se | sap_internet_graphics_server | — | — |
| sap_se | sap_internet_graphics_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for HTTP POST requests to the /XMLCHART endpoint with multipart/form-data content type containing XML payloads with XXE entity declarations (e.g., SYSTEM entity referencing local files). ↗
- →Successful exploitation responses from the SAP IGS server will contain the words 'Picture', 'Info', and '/output/' together in the response body, and either 'ImageMap' or 'Errors', with a Content-Type header of 'text/html' and 'SAP Internet Graphics Server'. ↗
- →Look for multipart POST requests to /XMLCHART where one of the parts contains an XML file with an external entity declaration (<!ENTITY xxe SYSTEM ...>) referencing local file paths such as /etc/passwd, indicating file read exploitation. ↗
- →The exploit targets unauthenticated remote attackers — no authentication headers are required in the POST request to /XMLCHART, which can be used as a detection signal for anomalous unauthenticated POST traffic to this endpoint. ↗
- ·The vulnerability affects only specific SAP IGS versions: 7.20, 7.20EXT, 7.45, 7.49, and 7.53. Detection rules should be scoped to these versions to reduce false positives. ↗
- ·This module covers two CVEs (CVE-2018-2392 and CVE-2018-2393) via the same attack vector and endpoint; detections targeting /XMLCHART XXE will apply to both vulnerabilities simultaneously. ↗
- ·The XXE can be abused for both file read and denial-of-service; detection logic should account for both attack outcomes, not just data exfiltration patterns. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j629-mr84-x8mf: Under certain conditions SAP Internet Graphics Server (IGS) 7
ghsa_unreviewed·2022-05-14
CVE-2018-2392 [HIGH] CWE-611 GHSA-j629-mr84-x8mf: Under certain conditions SAP Internet Graphics Server (IGS) 7
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.
VulnCheck
SAP internet_graphics_server Improper Restriction of XML External Entity Reference
vulncheck·2018·CVSS 7.5
CVE-2018-2392 [HIGH] SAP internet_graphics_server Improper Restriction of XML External Entity Reference
SAP internet_graphics_server Improper Restriction of XML External Entity Reference
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.
Affected: SAP internet_graphics_server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://app.crowdsec.net/cti/cve-explorer/CVE-2018-2392
Exploit PoC: https://vulncheck.com/xdb/967ff7911b2b
No detection rules found.
Metasploit
SAP Internet Graphics Server (IGS) XMLCHART XXE
metasploit·CVSS 7.5
CVE-2018-2392 [HIGH] SAP Internet Graphics Server (IGS) XMLCHART XXE
SAP Internet Graphics Server (IGS) XMLCHART XXE
This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities within the XMLCHART page of SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag when submitting a POST request to the XMLCHART page to generate a new chart. Successful exploitation will allow unauthenticated remote attackers to read files from the server as the user from which the IGS service is started, which will typically be the SAP admin user. Alternatively attackers can also abuse the XXE vulnerability to conduct a denial of service attack against the vulnerable SAP IGS server.
Nuclei
SAP Internet Graphics Server (IGS) - XML External Entity Injection
nuclei·CVSS 7.5
CVE-2018-2392 [HIGH] SAP Internet Graphics Server (IGS) - XML External Entity Injection
SAP Internet Graphics Server (IGS) - XML External Entity Injection
SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection (XXE) vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag when submitting a POST request to the XMLCHART page to generate a new chart.
Template:
id: CVE-2018-2392
info:
name: SAP Internet Graphics Server (IGS) - XML External Entity Injection
author: _generic_human_
severity: high
description: |
SAP Internet Graphics Servers (IGS) running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection (XXE) vulnerabilities within the XMLCHART page - CVE-2018-2392
No writeups or analysis indexed.
2018-02-14
Published
Exploited in the wild