SAP security note 2806403, "[CVE-2019-0370] Multiple Vulnerabilities in SAP Financial Consolidation". Below are the symptom and SAP recommended solution.
Description
Symptom
The SAP security note addresses several vulnerabilities identified in SAP Financial Consolidation. The vulnerability details along with their CVE relevant information are outlined below.
1. XPath Injection. SAP Financial Consolidation legacy web enables malicious users to use crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query. CVE-2019-0370. CVSS Score: 5.4, Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. Impact: exploitation of an XPath injection flaw to read sensitive application data or interfere with application logic.
2. Cross Site Scripting (XSS). The SAP Financial Consolidation legacy web client does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. CVE-2019-0369. CVSS Score: 5.4, Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Impact: deface or modify content displayed on the website; steal user authentication information; impersonate users and access information with the same privileges as the target user.
Solution
- XPath Injection: All user inputs are now escaped to prevent malicious XPath commands.
- XSS Vulnerability: User file uploads are escaped and sanitized to prevent the execution of malicious scripts in the browser.
- Update Required: Upgrade your SAP Financial Consolidation server installation to a support package, patch, or release where the issues are resolved. Refer to the Support Packages & Patches section for details and available patches.
References
- SAP Note 2806403
- CVE-2019-0370 Details
- CVE-2019-0369 Details
Full note on SAP: SAP Support Launchpad note 2806403
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].