Update 1 to Security Note 2752614 – CVE-2019-0319 Content Injection Vulnerability in SAP Gateway, SAP security note 2911267

SAP security note 2911267, "Update 1 to Security Note 2752614 – [CVE-2019-0319] Content Injection Vulnerability in SAP Gateway". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The SAP Gateway allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it’s not. This update covers the fix for additional releases.

Solution

This correction ensures that only OData ABNF syntax is allowed within the URI based on the corresponding OData version. The correction is delivered in the release listed in the Support Packages and Patches section of this Note. Please apply this SAP Security Note.

Reason and prerequisites

An OData client can enrich the HTTP Request in a way that allows the error information provided by the backend to be correlated with the client environment.

Request:
GET ../oDataService/0001/'.%20Please%20visit%20http://www.google.de

Response:
404 - Not Found
...
<message xml:lang="en">Resource not found for the segment ''. Please visit http://www.evilwebsite.com</message>
...

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• SAP Note 2752614 – CVE-2019-0319

Affected components

• GW_CORE: 200
• SAP_GWFND: 740