CVE-2023-42478
📋 TL;DR
SAP Business Objects Business Intelligence Platform contains a stored cross-site scripting (XSS) vulnerability that allows authenticated attackers to upload malicious documents. When other users open these documents, attackers can execute arbitrary JavaScript in their browser sessions, potentially compromising application integrity. This affects organizations using vulnerable versions of SAP Business Objects BI Platform.
💻 Affected Systems
- SAP Business Objects Business Intelligence Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts and sensitive business data.
Likely Case
Attackers with authenticated access upload malicious documents that execute JavaScript when opened by other users, potentially stealing session tokens or performing unauthorized actions.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution, preventing successful exploitation.
🎯 Exploit Status
Exploitation requires authenticated access to upload documents; complexity is low once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to SAP Note 3382353 for specific patch versions and updates.
Vendor Advisory: https://me.sap.com/notes/3382353
Restart Required: Yes
Instructions:
1. Review SAP Note 3382353 for patch details. 2. Apply the relevant SAP Security Note or update to a patched version. 3. Restart the SAP Business Objects BI Platform services. 4. Verify the fix by testing document upload functionality.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of uploaded document content to prevent XSS payloads.
Content Security Policy (CSP)
allDeploy a strict CSP to mitigate the impact of XSS by restricting script execution sources.
🧯 If You Can't Patch
- Restrict document upload permissions to trusted users only.
- Implement web application firewalls (WAF) with XSS protection rules.
🔍 How to Verify
Check if Vulnerable:
Test by uploading a document with a simple XSS payload (e.g., <script>alert('test')</script>) and check if it executes when opened.Check Version:
Check the SAP Business Objects BI Platform version via the Central Management Console (CMC) or administrative interfaces.Verify Fix Applied:
After patching, repeat the vulnerability test; the XSS payload should be sanitized and not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual document uploads, especially with script-like content in filenames or metadata.
- Errors or warnings related to document processing or security filters.
Network Indicators:
- HTTP requests uploading documents with suspicious content types or parameters.
SIEM Query:
Search for events where document uploads contain strings like '<script>', 'javascript:', or other common XSS patterns in request payloads.