SAP security note 2630018, "CVE-2018-2445 Server Side Request Forgery (SSRF) Vulnerability in SAP BusinessObjects BI Platform Servers AdminTools". Below are the symptom and SAP recommended solution.
Description
Symptom
AdminTools allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application, resulting in a Server Side Request Forgery (SSRF) vulnerability.
Some well-known impacts are:
- Information gathering for further exploits/attacks
- Availability of the system
Solution
This issue is fixed in the patches listed in the "Support Package Patches" section below.
To prevent SSRF:
- Create a Whitelist: Define valid CMS names or IPs along with their port numbers in the allowed.cms property within the AdminTools.properties file located at <BOEInstallDir>\tomcat\webapps\AdminTools\WEB-INF. For releases with a new location, refer to the Support Package Patches section.
- Edit the AdminTools.properties File: Copy the AdminTools.properties file to the custom folder from the default folder if applicable. Add the CMS names or IPs and port numbers in the format: allowed.cms = <cms_name_or_IP>:<port_number>, <cms_name_or_IP>:<port_number>. Example: allowed.cms = cms.example.com:8080, 192.168.1.100:8080.
- Restart the Web Application Server: After making changes, restart the server to apply the configuration.
For a secure login and to prevent SSRF, ensure that only whitelisted CMS names or IPs are allowed. If the port number is omitted in the whitelist, the login will default to the standard port, and any deviations will result in a failed login attempt.
CVSS
Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L
References
- AdminTools.properties file getting updated after Patching
- CVE-2018-2370 Server Side Request Forgery (SSRF) vulnerability in Central Management Console, BI Launchpad and Fiori BI Launchpad
Full note on SAP: SAP Support Launchpad note 2630018
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].