CVE-2020-6308 Server-Side Request Forgery vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Services), SAP security note 2943844

SAP security note 2943844, "[CVE-2020-6308] Server-Side Request Forgery vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Services)", is a program error note released on 23.02.2021. Below are the symptom and SAP recommended solution.

Description

Symptom

UPDATE 23rd February 2021: This note has been re-released with updated ‘Reason and Prerequisites’ information.

SAP BusinessObjects Business Intelligence Platform (Web Services) allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful exploitation, an attacker can scan the internal network to determine internal infrastructure and gather information for further attacks such as remote file inclusion, retrieving server files, bypassing firewalls, and forcing the vulnerable server to perform malicious requests.

Solution

The allowlist of authorized CMS has been included in the product. Administrators must configure this before attempting any login. To do so, edit the dsws.properties file and configure the allowed.cms field with a comma-separated list of all authorized URLs, for example: allowed.cms=host:6400,host2:6400,host3:15678

This issue is fixed in the patches listed in the “Support Packages & Patches” section below.

For Business Intelligence Platform maintenance schedules and strategies, see Knowledge Base Article 2144559 in the References section.

Reason and prerequisites

The logon pages of tools using dswsbobje (Web Services) for login allow users to enter a custom CMS host and port number. An attacker can use common techniques to determine which ports are in use on the backend server. Web Services may call URLs that are not authorized by administrators.

CVSS

Score 5.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References