SAP security note 2174357, "Reflected File Download Vulnerability in KM Documents Servlet". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
There is a possibility that the end user is offered to download a non-existing executable file containing malicious code when certain query parameters are specified in the request URL to the KM Documents Servlet. The downloaded file may have an executable extension but is most probably not runnable because of corrupted content.
Solution
Refer to the "Support Packages & Patches" link to view the versions including the fix.
Reason and prerequisites
KM Documents Servlet allows users to specify additional HTTP request parameters. The combination of ‘URI’ and ‘action’ parameters may lead to the download of a non-existing file by the end user. The file will be created when the server returns its HTTP response. This behavior of the KM Documents Servlet may be exploited as a Reflected File Download (RFD) vulnerability, and an attacker can try to trigger an RFD attack. The created file cannot be run because its content will be corrupted.
CVSS
Score 5.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Affected components
- KMC-CM 7.00 to 7.02
- KMC-CM 7.30 to 7.30
- KMC-CM 7.31 to 7.31
- KMC-CM 7.40 to 7.40
- KMC-CM 7.50 to 7.50
Full note on SAP: SAP Support Launchpad note 2174357
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].