CVE-2022-31591
📋 TL;DR
CVE-2022-31591 is an unquoted service path vulnerability in SAP BusinessObjects BW Publisher Service that allows local attackers to execute arbitrary code with elevated privileges. Attackers can place malicious executables in the service path to gain SYSTEM-level access. This affects SAP BusinessObjects BW Publisher Service versions 420 and 430.
💻 Affected Systems
- SAP BusinessObjects BW Publisher Service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains SYSTEM privileges, enabling complete system compromise, data theft, lateral movement, and persistence.
Likely Case
Local authenticated user escalates privileges to SYSTEM, potentially installing malware, accessing sensitive data, or disrupting services.
If Mitigated
With proper access controls and monitoring, impact limited to isolated service disruption or detection of unauthorized privilege escalation attempts.
🎯 Exploit Status
Requires local access and ability to write to service path directories. Classic unquoted service path exploitation technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3167430
Vendor Advisory: https://launchpad.support.sap.com/#/notes/3167430
Restart Required: Yes
Instructions:
1. Download and apply SAP Security Note 3167430. 2. Restart the SAP BusinessObjects BW Publisher Service. 3. Verify the service path is properly quoted in Windows Service configuration.
🔧 Temporary Workarounds
Manually Quote Service Path
windowsManually edit the service path in Windows Services to add quotes around the executable path
sc config "SAP BusinessObjects BW Publisher Service" binPath="\"C:\Program Files\SAP\...\executable.exe\""
Restrict Write Permissions
windowsRemove write permissions for non-administrative users on directories in the service path
icacls "C:\Program Files\SAP\BusinessObjects\" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict access controls to prevent local users from writing to service path directories
- Monitor for unauthorized service modifications and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if SAP BusinessObjects BW Publisher Service path contains spaces and is unquoted in Windows Services (services.msc)Check Version:
Check SAP BusinessObjects version through Central Management Console or review installation logsVerify Fix Applied:
Verify service path is properly quoted in Windows Services and confirm SAP Security Note 3167430 is applied📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs: Service control manager events (7036, 7040), unauthorized service modifications
- SAP Audit Logs: Unusual service restarts or configuration changes
Network Indicators:
- Unusual outbound connections from SAP BusinessObjects service
- Lateral movement attempts from SAP server
SIEM Query:
EventID=7045 OR EventID=4697 AND ServiceName="SAP BusinessObjects BW Publisher Service"