CVE-2020-6195 Multiple vulnerabilities in SAP Business Objects Business Intelligence Platform, SAP security note 2878507

SAP security note 2878507, “Multiple vulnerabilities in SAP Business Objects Business Intelligence Platform”. Below are the symptom, SAP recommended solution and references.

Description

Symptom

This SAP Security Note addresses several vulnerabilities identified in SAP Business Objects Business Intelligence Platform. The vulnerability details along with their CVE relevant information can be found below.

Information Disclosure: Passwords submitted to the application are returned in clear form in later responses from the application. CVE: CVE-2020-6195. CVSS: 6.4 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

URL Redirection: AdminTools of SAP BI allows an attacker to redirect users to a malicious site due to insufficient URL validation. CVE: CVE-2020-6211. CVSS: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Impacts:

• Phishing attacks to steal credentials of the victim
• Redirect users to untrusted webpages containing malware or similar malicious exploits

Content Spoofing: The open document area allows an attacker to modify certain error pages to include malicious content. This can misdirect a user who is tricked into accessing these error pages rendered by the application. CVE: CVE-2020-6223. CVSS: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Cross-Site Scripting (XSS): The following XSS vulnerabilities have been identified:

• Stored & Reflected XSS (Web Intelligence HTML interface). CVE: CVE-2020-6221. CVSS: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
• Information Disclosure (AdminTools/Query Builder). CVE: CVE-2020-6218. CVSS: 5.0 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
• Reflected XSS (SAP BusinessObjects BI and CMC). CVE: CVE-2020-6220. CVSS: 4.4 (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N)

Impacts of XSS: deface or modify displayed content from a website; steal authenticated information of the user, such as session data; impersonate the user and access information with the same rights as the target user.

Solution

• Information Disclosure: Removed the hardcoded part where the password was explicit to avoid password transparency.
• URL Redirection: Implemented validation before redirecting the URL and restricted redirection to the AdminTools component.
• Content Spoofing: Restricted content on the page to standard error logs, circumventing the vulnerability.
• XSS: Properly encoded user inputs and URL parameters to prevent successful XSS attacks.

This issue is fixed in the patches listed in the “Support Packages & Patches” section below. For the Business Intelligence Platform maintenance schedule and strategy, see Knowledge Base Article 2144559 in the References section.

Reason and prerequisites

• Information Disclosure: Passwords are reflected back as a result of the server’s response.
• URL Redirection: AdminTools application opens redirecting links without validation.
• Content Spoofing: The application allows information to be passed as part of the URL.
• XSS: Certain parameters are not encoded in the application. Users must be logged into the BI platform to perform XSS attacks.

References

• BI 4.x Maintenance Strategy & Schedule