SAP security note 2826782, “Denial of Service in SAP BusinessObjects Mobile (CVE-2020-6196)”. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP BusinessObjects Mobile (MobileBIService) allows an unauthenticated attacker using a specially-crafted payload to send requests to certain endpoints. These requests can overload the impacted servlet, rendering it unresponsive. This results in a denial of service situation, preventing legitimate users from accessing the impacted component until it is explicitly restarted.
Solution
MobileBIService now validates the authenticity of notification requests. Unauthorized requests are discarded, while authorized requests have their payloads parsed and processed.
Steps to configure the solution are documented in the BI Mobile Server deployment guide. Customers can also refer to the SAP Note 2824635 – Best Practices for configuring Push Notification in SAP BusinessObjects BI Mobile App.
Reason and prerequisites
Reason: No authentication was in place for notification requests in MobileBIService.
Prerequisite: The attacker must be on the same network where MobileBIService is deployed.
CVSS
Score 7.5 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Full note on SAP: SAP Support Launchpad note 2826782
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].