SAP Security Note 1908562 - Port scanning in BusinessObjects Explorer

2014-10-14T00:00:00
ID SECURITYVULNS:DOC:31159
Type securityvulns
Reporter Securityvulns
Modified 2014-10-14T00:00:00

Description

COMPASS SECURITY ADVISORY

http://www.csnc.ch/en/downloads/advisories.html

Product: BusinessObjects Explorer

Vendor: SAP AG

Subject: Potential information disclosure relating to SBOP Explorer

Risk: Medium

Effect: Remotely exploitable

Author: Stefan Horlacher

Date: 2014-10-10

SAP Security Note: 1908562 [0]

Abstract:

BusinessObjects Explorer does not validate the user defined inputs of parameter CMS name, which consists of a host name and port number. This can be used to perform a port scan within the network range where the BusinessObject Explorer server is located. This vulnerability could be triggered as unauthenticated user.

Affected:

Vulnerable: SAP BusinessObjects Explorer version 14.0.5 (build 882)

Not tested: Other versions of BusinessObjects Explorer

Technical Description:

It is possible to disable that a user is able to choose the CMS feature. Nonetheless, the client sends this value to the server where it gets interpreted. This allows abusing this feature for port scanning purposes as it is possible to determine a port's state from the response time.

A request with a valid host and open port will get a time-out response after 10 seconds while a request to an invalid host name or closed port will return an error in less than 500 milliseconds.

URL: /explorer/polestar_xml.jsp
Request extract:
    POST /explorer/polestar_xml.jsp HTTP/1.1
    [CUT BY COMPASS]
    Content-Length: 187
    xmlParameter=<dataDiscovery><request><logon user="[CUT BY COMPASS]" password="[CUT BY
    COMPASS]" cms="[CUT BY COMPASS: HOST_AND_PORT_HERE]" authentication="[CUT BY COMPASS]"
    locale="en_US" guid=""/></request></dataDiscovery>

Response extract:
    HTTP/1.1 200 OK
    [CUT BY COMPASS]
    <?xml version="1.0" encoding="UTF-8"?><dataDiscovery>
    <response>
    <status code="ERROR" message="PS_10001_INVALID_CREDENTIALS_LOGON">
    <detail message="Server [CUT BY COMPASS] not found or server may be down (FWM 01003)"/>
    </status>
    </response>
    </dataDiscovery>

Timeline:

2013-06-06: Discovery by Stefan Horlacher 2013-06-26: Initial vendor notification 2013-12-10: Vendor releases patch and SAP Security Note 1908562 2014-10-10: Disclosure of the advisory

References:

[0] https://service.sap.com/sap/support/notes/1908562