SAP security note 2493727, "[CVE-2018-2370] Server Side Request Forgery (SSRF) Vulnerability in Central Management Console, BI Launchpad, and Fiori BI Launchpad", is a note. Below are the symptom, CVSS score, reason and prerequisites, SAP recommended solution and the affected software components.
Description
Symptom
Central Management Console, BI Launchpad, and Fiori BI Launchpad allow an attacker to manipulate the vulnerable application to send crafted requests, resulting in an SSRF vulnerability. Potential impacts include:
- Information gathering for further exploits/attacks
CVSS
Score 5.8/10 Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Reason and prerequisites
The login pages of CMC and BI Launchpad (when enabled) allow users to enter a custom CMS host and port number. An attacker can use common techniques to determine which ports are in use on the backend server.
Solution
To mitigate this SSRF vulnerability, implement a whitelist of valid CMS names or IPs along with port numbers. The application will allow login only if the entered values match those in the whitelist.
Steps:
- Edit the global.properites file located in <BOEInstallDir>\tomcat\webapps\BOE\WEB-INF\internal.
- Enter the list of CMS names or IPs along with port numbers in the allowed.cms property, for example allowed.cms=<cms name or IP>:<port number>. For multiple CMSes, separate them with commas: allowed.cms=<cms1>:<port1>,<cms2>:<port2>.
- If using a clustered CMS, ensure that both the cluster name and specific CMS names are present in the allowed.cms property.
To log in using either CMS name or IP, add both to the allowed.cms property. If the port number is omitted, the default port will be used.
Exceptions:
- Default configurations where cms.visible is set to false and a default CMS is configured.
- Login via Single Sign-On.
Affected components
- ENTERPRISE: Versions 410, 420+, 430+
Full note on SAP: SAP Support Launchpad note 2493727
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].