Log injection and missing size restriction in SAP HANA Extended Application Services Classic (XS), SAP security note 2241978

SAP security note 2241978, “Log injection and missing size restriction in SAP HANA Extended Application Services Classic (XS)”. Below are the symptom and SAP recommended solution.

Description

Symptom

A potential attacker can perform malicious calls to the debug functions of the SAP HANA Extended Application Services Classic (XS).

Solution

Update: The debug function has been improved with SAP HANA revision 102.02 for SPS10 or later. Update to this or a later version. SPS 11 is not affected.

Workaround:

• Use the internal HANA Web Dispatcher to block debugger requests by adding the following parameter in the webdispatcher.ini configuration section [profile]: icm/HTTP/auth_1 = PREFIX=/sap/hana/xs/debugger, PERMFILE=/dev/null
• Alternatively, block access to the URLs /sap/hana/xs/debugger/* at the network layer (e.g., with a firewall or reverse proxy).

Please note that applying the workaround will disable debugging of SAP HANA Extended Application Services (XS), including XS debugging via SAP HANA Studio.

Reason and prerequisites

An unauthenticated attacker might be able to create specially crafted HTTP requests to the SAP HANA Extended Application Services Classic debug function. This can lead to forged additional entries in the trace files of the XS process and consume disk space of the HANA system. Additionally, specially crafted HTTP requests can consume available memory buffers and lead to a crash of the XS process, which will be restarted automatically by the SAP HANA system. Existing data cannot be changed or read by this vulnerability.

CVSS

Score 5.0 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N