CVE-2018-2420 Unrestricted File Upload in SAP Internet Graphics Server (IGS), SAP security note 2615635

SAP security note 2615635, "[CVE-2018-2420] Unrestricted File Upload in SAP Internet Graphics Server (IGS)", is a note released on May 8, 2018. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Internet Graphics Server (IGS) allows an attacker to upload any file (including script files) without proper file format validation.

Impacts of this Vulnerability:

• Malicious file insertion or modification
• Increased susceptibility to other attacks such as Cross-Site Scripting (XSS)

Solution

SAP IGS now validates the file format and only permits supported shapefiles to be uploaded. To apply the security correction:

• Optional: If uploading shapefiles is not required for your business use case, you can disable this functionality by adding the parameter igs/pw/install = disable to your IGS instance profile. A restart of the IGS instance is necessary for the changes to take effect.

CVSS

Score 6.5 Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected components

• Basis Components > Frontend Services (SAP Note 1322184) > Internet Graphics Server (7.20, 7.20EXT, 7.45, 7.49, 7.53)