bugtraq - SAP Security Note 1908562 - Port scanning in BusinessObjects Explorer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4B70B66DA655F144855183C68062EE8901B8E5FC@trexchange.csnc.ch>
Date: Fri, 10 Oct 2014 07:35:46 +0200
From: "Alexandre Herzog" <alexandre.herzog@...c.ch>
To: <bugtraq@...urityfocus.com>, <fulldisclosure@...lists.org>
Subject: SAP Security Note 1908562 - Port scanning in BusinessObjects Explorer

#######################################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#######################################################################
#
# Product:           BusinessObjects Explorer
# Vendor:            SAP AG
# Subject:           Potential information disclosure relating to SBOP Explorer
# Risk:              Medium
# Effect:            Remotely exploitable
# Author:            Stefan Horlacher
# Date:              2014-10-10
# SAP Security Note: 1908562 [0]
#
#######################################################################

Abstract:
-------------
BusinessObjects Explorer does not validate the user defined inputs of 
parameter CMS name, which consists of a host name and port number. 
This can be used to perform a port scan within the network range where 
the BusinessObject Explorer server is located.
This vulnerability could be triggered as unauthenticated user.


Affected:
---------
Vulnerable:
SAP BusinessObjects Explorer version 14.0.5 (build 882)

Not tested:
Other versions of BusinessObjects Explorer


Technical Description:
----------------------
It is possible to disable that a user is able to choose the CMS feature.
Nonetheless, the client sends this value to the server where it gets
interpreted. This allows abusing this feature for port scanning 
purposes as it is possible to determine a port's state from the 
response time.

A request with a valid host and open port will get a time-out response 
after 10 seconds while a request to an invalid host name or closed 
port will return an error in less than 500 milliseconds.

	URL: /explorer/polestar_xml.jsp
	Request extract:
		POST /explorer/polestar_xml.jsp HTTP/1.1
		[CUT BY COMPASS]
		Content-Length: 187
		xmlParameter=<dataDiscovery><request><logon user="[CUT BY COMPASS]" password="[CUT BY
		COMPASS]" cms="[CUT BY COMPASS: HOST_AND_PORT_HERE]" authentication="[CUT BY COMPASS]"
		locale="en_US" guid=""/></request></dataDiscovery>
		
	Response extract:
		HTTP/1.1 200 OK
		[CUT BY COMPASS]
		<?xml version="1.0" encoding="UTF-8"?><dataDiscovery>
		<response>
		<status code="ERROR" message="PS_10001_INVALID_CREDENTIALS_LOGON">
		<detail message="Server [CUT BY COMPASS] not found or server may be down (FWM 01003)"/>
		</status>
		</response>
		</dataDiscovery>


Timeline:
---------
2013-06-06:     Discovery by Stefan Horlacher
2013-06-26:     Initial vendor notification
2013-12-10:     Vendor releases patch and SAP Security Note 1908562
2014-10-10:     Disclosure of the advisory


References:
-----------
[0] https://service.sap.com/sap/support/notes/1908562

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5234 bytes)