Vulnerabilities 2010

PR09-02 Multiple Cross-Site Scripting (XSS) / Cross Domain redirects and Server path information disclosure on SAP BusinessObjects version 12

• Advisory publicly released: Monday, 18 January 2010
• Vulnerability found: Monday, 4 May 2009
• Vendor informed: Tuesday, 5 May 2009
• Severity level: Medium

• Credits
  Found by Richard Brain - ProCheckUp Ltd (www.procheckup.com).
• Description
  SAP BusinessObjects version 12 is vulnerable to Multiple Cross-Site Scripting (XSS) / Cross Domain redirects and Server path information disclosure.
  
  Notes:
  
  - Cross-domain redirection:
  
  A remote URI redirection vulnerability affects multiple programs within Business Objects. This issue is due to a failure of Business Objects to properly sanitize URI-supplied data assigned to the 'url' or ëlocí parameter and some other parameters and to keep redirections within the site. An attacker may leverage this issue to carry out convincing phishing attacks against unsuspecting users by causing an arbitrary page to be loaded once a Business Objects specially-crafted URL is visited.
  
  
  - Cross-Site Scripting:
  
  Cross site scripting (XSS) vulnerabilities affects multiple programs within Business Objects. This issue is caused by the failure of Business Objects to properly sanitise URI-supplied data assigned to parameters.
  An attacker may leverage this issue to cause execution of malicious scripting code in the browser of a victim user who visits a malicious third-party page. Such code would run within the security context of the target domain.
  This type of attack can result in non-persistent defacement of the target site, or the redirection of confidential information (i.e.: session IDs, address books, emails) to unauthorised third parties. The following attacks work universally not requiring authentication (unathenticated)
  
  
  - Server path and SQL server information disclosure:
  
  Various Business Object programs disclose the server root of its installation, and the type of the SQL server used when the source code of the web page is viewed. This information can be used to carry out further attacks.
• Proof of concept
  
• How to fix
  
• Consecuences
  An attacker may be able to cause execution of malicious scripting code in the browser of a victim user who clicks on a link to a SAP Business Object server.
  
  This type of attack can result in non-persistent defacement of the target site, or the redirection of confidential information (i.e.: session IDs or passwords) to unauthorised third parties.
  
  Further information can be found on the following paper: BusinessObj.pdf
• Successfully tested on
  SAP BusinessObjects 12 and 12 SP1.
  http://www.sap.com/solutions/sapbusinessobjects/index.epx
• References
  
  
• Legal
  Copyright 2009 Procheckup Ltd. All rights reserved.
  
  Permission is granted for copying and circulating this Bulletin to the Internet community
  for the purpose of alerting them to problems, if and only if, the Bulletin is not edited
  or changed in any way, is attributed to Procheckup, and provided such reproduction and/or
  distribution is performed for non-commercial purposes.
  
  
  Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.