CVE-2020-6278 Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC), SAP security note 2912708

SAP security note 2912708, “[CVE-2020-6278] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Launchpad and CMC)”, is a note. Below are the symptom, SAP recommended solution and reason and prerequisites.

Description

Symptom

SAP Business Objects BI Launchpad and Central Management Console (CMC) are vulnerable to a stored Cross-Site Scripting (XSS) attack. An attacker can embed malicious scripts by uploading malformed images. These scripts execute when a victim accesses the infected files, leading to stored XSS.

Solution

This vulnerability has been addressed in various support package patches. Administrators should apply the appropriate patches and configure the upload.file.allowed.formats property to enforce MIME type validation.

Edit the global.properties file to define allowed file formats and their corresponding MIME types so that uploaded files are validated against their MIME types. In SAP BusinessObjects Business Intelligence 4.1 with the latest service patch, this file is located at <INSTALLED_APPLICATION-SERVER_DIR>\<APPLICATION_SERVER>\webapps\BOE\WEB-INF\internal\global.properties. Example configuration: upload.file.allowed.formats=jpg,image/jpeg,png,image/png. Only files with the specified extensions and MIME types are then accepted; a mismatch displays the error "File type doesn’t match".

Reason and prerequisites

When uploading local documents in BI Launchpad and CMC, the MIME type of the file must match its actual file type. Failure to enforce this validation can allow malicious scripts to be executed.

CVSS

Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

• SAP Note 2315665: File Types supported for upload Local document in Infoview and CMC
• SAP Note 2144559: BI 4.x Maintenance Strategy & Schedule