SAP security note 2984627, "[CVE-2020-26815] Security Vulnerabilities in SAP Fiori Launchpad NewsTile Application". Below are the symptom and SAP recommended solution.
Description
Symptom
Server-Side Request Forgery (SSRF) Attack (CVE-2020-26815): allows unauthorized attackers to send crafted requests to internal systems behind firewalls, potentially accessing sensitive resources.
Reflected Cross-Site Scripting (XSS) (CVE-2020-26825): enables attackers to inject malicious code into the NewsTile Application, which can be executed in the victim’s browser, leading to information disclosure.
Solution
Apply SAP Security Note 2984627 to mitigate the identified vulnerabilities. The solution restricts the NewsTile Application to use feed URLs only from:
- Internal Sources: same URL and port as the Suite Page Builder application.
- External CORS-Compliant Sources.
CVSS
Score 8.6 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2984627
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
