CVE-2020-6308

MEDIUMNuclei

SAP businessobjects_business_intelligence_platform Server-Side Request Forgery (SSRF)

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-6308 has a selected CVSS score of 5.3 (medium); EIP currently links 4 repository PoCs and 1 Nuclei template.

Description

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 14, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
4
Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

businessobjects_business_intelligence_platform

Browse SAP / businessobjects_business_intelligence_platform
VulnCheckVersion data not supplied

SAP BusinessObjects Business Intelligence Platform (Web Services)

Browse SAP SE / SAP BusinessObjects Business Intelligence Platform (Web Services)
CVE List< 410affected
< 420affected
< 430affected

Proofs of concept

4

Repository PoCs

GitHubInitRoot/CVE-2020-6308-PoCRepository PoCby InitRoot36Not analyzed6 files

455.5 KiB

GitHub
PoC details
GitHubfreeFV/CVE-2020-6308-mass-exploiterRepository PoCby freeFV0Not analyzed2 files

2.5 KiB

GitHub
PoC details
GitHubTheMMMdev/CVE-2020-6308Repository PoCby TheMMMdev1Not analyzed2 files

4.1 KiB

GitHub
PoC details
GitHubMachadoOtto/sap_bo_launchpad-ssrf-timing_attackRepository PoCby MachadoOtto0Not analyzed3 files

5.2 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMSAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request ForgeryCVSS 5.3

SAP BusinessObjects Business Intelligence Platform (Web Services) 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful exploitation, attacker can scan network to determine infrastructure and gather information for further attacks like remote file inclusion, retrieving server files, bypassing firewall, and forcing malicious requests.

Impact

Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access to internal resources or further attacks.

Remediation

Apply the relevant security patches provided by SAP to mitigate this vulnerability.

WeaknessesCWE-918
Authorsmadrobot
Template tagscve2020cvesapssrfoastunauthvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:sap:businessobjects_business_intelligence_platform:4.1:-:*:*:*:*:*:*
https://github.com/InitRoot/CVE-2020-6308-PoC https://launchpad.support.sap.com/#/notes/2943844 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196 https://nvd.nist.gov/vuln/detail/CVE-2020-6308 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3