CVE-2018-2392 Scanner

SAP Internet Graphics Server (IGS) is a core component in SAP landscapes, responsible for rendering dynamic graphics, charts, and images for web applications and mobile interfaces. It is widely deployed in enterprises for generating real-time visualizations in business processes like reporting, dashboards, and e-commerce. Administrators and developers rely on IGS to deliver high-performance graphical output across SAP systems.

CVE-2018-2392 is an XML External Entity (XXE) vulnerability that arises when SAP IGS processes XML input without properly disabling external entity resolution. This flaw occurs due to insecure default configurations in the XML parser library, allowing attackers to inject malicious XML payloads that reference external resources. The vulnerability is rated CVSS 7.5, indicating high severity with potential for data confidentiality breaches.

Technically, the vulnerability is triggered by sending crafted XML data to the IGS HTTP service, specifically through endpoints that handle XML-based requests for graphic generation. The vulnerable parameter is the XML body itself, where an attacker can define external entities pointing to local files like /etc/passwd or application configuration files. The server then returns the file contents in the response, enabling unauthenticated data theft.

If exploited, an attacker can read sensitive files from the SAP IGS server, including credentials, configuration data, and business-critical information. This can lead to further lateral movement within the SAP environment, compromise of connected systems, and potential regulatory non-compliance due to data exposure. The impact is especially severe in production environments where IGS handles high-value data.