CVE-2023-42472
📋 TL;DR
This vulnerability allows authenticated attackers to bypass file type validation in SAP BusinessObjects Business Intelligence Platform's Web Intelligence HTML interface. By intercepting and modifying image upload requests, attackers can read and modify sensitive data. This affects organizations using SAP BusinessObjects BI Platform version 420.
💻 Affected Systems
- SAP BusinessObjects Business Intelligence Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive business data, modify financial reports, or inject malicious content into business intelligence systems.
Likely Case
Unauthorized access to confidential business reports and data manipulation within the BI platform.
If Mitigated
Limited impact with proper network segmentation and strict access controls preventing unauthorized users from accessing the interface.
🎯 Exploit Status
Requires authentication and ability to intercept/modify network traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Note 3370490
Vendor Advisory: https://me.sap.com/notes/3370490
Restart Required: Yes
Instructions:
1. Download and apply SAP Note 3370490. 2. Restart the SAP BusinessObjects BI Platform services. 3. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Restrict Network Access
allLimit access to the Web Intelligence HTML interface to trusted networks only.
Implement WAF Rules
allConfigure web application firewall to block suspicious file upload patterns.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the BI platform from untrusted networks.
- Enforce least privilege access controls and monitor all authenticated user activity.
🔍 How to Verify
Check if Vulnerable:
Check if SAP BusinessObjects BI Platform version 420 is installed without SAP Note 3370490 applied.Check Version:
Check SAP system information or consult SAP administration tools for version details.Verify Fix Applied:
Verify SAP Note 3370490 is applied in the system and test file upload functionality with modified content types.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Modified content-type headers in upload requests
- Failed file validation attempts
Network Indicators:
- Intercepted/modified HTTP requests to upload endpoints
- Suspicious file extensions in upload traffic
SIEM Query:
Search for file upload events with content-type mismatches or unusual file extensions in web server logs.