SAP Security Note
Medium priority
SAP security note 2752614, “[CVE-2019-0319] Content Injection Vulnerability in SAP Gateway”, is a note released on June 9, 2020. Below are the symptom, SAP recommended solution and reason and prerequisites.
Description
Symptom
An attacker can manipulate the SAP Gateway to inject content into error messages, misleading users about the authenticity of the information displayed.
For example, a request such as "GET ../oDataService/0001/’ . Please visit http://www.google.de" can cause the server to return an error message containing attacker-controlled text, for example: "404 – Not Found … Resource not found for the segment ”. Please visit http://www.evilwebsite.com".
Solution
Apply the correction provided in this SAP Security Note to ensure that only OData ABNF syntax is permitted within the URI based on the corresponding OData version. This prevents the injection of unauthorized content.
Reason and prerequisites
An OData client can craft HTTP requests in a specific manner that allows the backend to correlate error information with the client environment, facilitating content injection.
CVSS
Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- CVE-2019-0319
Full note on SAP: SAP Support Launchpad note 2752614
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].