SAP Security Note
SAP security note 2522510, "[CVE-2017-16680] Potential audit log injection vulnerability in SAP HANA XS Advanced", released on December 12, 2017. Below are the symptom and SAP recommended solution.
Description
Symptom
Two potential audit log injections have been identified in SAP HANA Extended Application Services, advanced model:
Controller Service Vulnerability: Certain HTTP/REST endpoints of the controller service lack proper user input validation, allowing unprivileged attackers to forge audit log lines. This can hinder or misdirect the interpretation of audit log files.
UAA Log Escaping Issue: The User Account and Authentication (UAA) service writes audit logs to both syslog and a log file. The entries in the log file miss proper escaping, potentially hindering or misdirecting the interpretation of audit log files, while entries in syslog remain correct.
Solution
The vulnerability has been addressed in SAP HANA Extended Application Services, advanced model (XS Advanced) version 1.0.63. It is recommended to apply this or a later version to mitigate the risks.
As an interim measure, customers should configure the XSA Controller to write audit log lines exclusively to syslog, thereby avoiding the vulnerable file system logs. This can be achieved by setting the property syslog to true in the [audit] section of the xscontroller.ini file. Note that UAA continues to write audit log entries to syslog (which is not vulnerable) and the file system.
CVSS
Score 5.3 / 10 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2522510
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].