CVE-2020-26831
📋 TL;DR
This vulnerability in SAP BusinessObjects BI Platform allows attackers with basic privileges to upload malicious XML entities during crystal report generation, leading to file disclosure, directory traversal, SSRF, and denial-of-service attacks. It affects SAP BusinessObjects BI Platform versions 4.1, 4.2, and 4.3. Users with access to crystal report generation functionality are at risk.
💻 Affected Systems
- SAP BusinessObjects BI Platform
📦 What is this software?
Businessobjects Business Intelligence Platform by Sap
View all CVEs affecting Businessobjects Business Intelligence Platform →
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through SSRF to internal services, sensitive data exfiltration via file disclosure, and service disruption via DoS.
Likely Case
Internal file and directory disclosure leading to information leakage and potential privilege escalation paths.
If Mitigated
Limited impact if proper input validation and network segmentation are implemented, though DoS risk remains.
🎯 Exploit Status
Exploitation requires basic user privileges but is technically straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 2989075
Vendor Advisory: https://launchpad.support.sap.com/#/notes/2989075
Restart Required: Yes
Instructions:
1. Download and apply SAP Security Note 2989075. 2. Restart affected SAP BusinessObjects services. 3. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Disable XML entity processing
allConfigure XML parsers to disable external entity resolution
Configure FEATURE_SECURE_PROCESSING and DISALLOW_DOCTYPE_DECL in XML parser settings
Restrict user privileges
allLimit crystal report generation to trusted users only
🧯 If You Can't Patch
- Implement strict input validation for XML uploads
- Network segmentation to limit SSRF impact and monitor for suspicious XML processing
🔍 How to Verify
Check if Vulnerable:
Check SAP BusinessObjects version and verify if SAP Security Note 2989075 is appliedCheck Version:
Check SAP BusinessObjects administration console or version filesVerify Fix Applied:
Verify SAP Security Note 2989075 is installed and test XML upload functionality📡 Detection & Monitoring
Log Indicators:
- Unusual XML processing errors
- Multiple failed XML upload attempts
- Suspicious file access patterns
Network Indicators:
- Unexpected outbound connections from SAP server
- Internal network scanning from SAP server
SIEM Query:
Search for 'XML parsing error' OR 'XXE' in SAP BusinessObjects logs