SAP Security Notes – April 2023

On the 11th of April 2023, SAP Security Patch Day saw the release of 19 new Security Notes.

There were 5 updates to previously released Security Notes.

Notes by severity

Highlights

On April Patch Day SAP presents 6 high-severity Notes with 5 of them rated as HotNews and one rated as a correction with high priority.

We will describe the corrections with the highest priority as a digest for today.

Starting with the usual Security updates for the browser control Google Chromium delivered with SAP Business Client presented in the Note 2622660 with a CVSS Score of 10.

Next to highlight are high-severity Notes dedicated to SAP NetWeaver, both ABAP and Java.

Note 3273480 has been re-released with updated ‘Support Packages & Patches’ information – Improper access control in SAP NetWeaver AS Java (User Defined Search), with a CVSS Score of 9.9. It describes the possibility for an attacker to have full read access for user data, along with compromising availability and integrity of the application. In order to access services that can be used to carry out unauthorised operations affecting users and data throughout the entire system, an unauthenticated attacker can attach to an open interface exposed by JNDI by the User Defined Search (UDS) of SAP NetWeaver AS Java over the network. 

The second Note 3294595 to highlight is another update, it was re-released with updated ‘Solution’ information – Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform, with a CVSS Score of 9.6. An attacker with non-administrative rights on SAP NetWeaver Application Server for ABAP and ABAP Platform is able to exploit a directory traversal vulnerability in available service to overwrite the system files. No data can be read during a such attack, but possibly crucial OS files can be rewritten, rendering the system unavailable.

The last high-priority Note covering SAP NetWeaver vulnerabilities is 3305907 – Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON), with a CVSS Score of 8.7. A report’s Directory Traversal vulnerability can be used by an attacker to upload and alter files on the SAP system. Data cannot be read, but if a remote attacker has enough administrative rights, they may be able to overwrite potentially crucial OS files, rendering the system unavailable. A corresponding Support Package application is necessary to mitigate the issue.

Now we will talk about SAP Diagnostics Agent Note with the set of fixes: 3305369 – Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge and EventLog ServiceCollector), with the highest CVSS Score of 10. The descriptions for vulnerabilities are presented by categories:

Unauthenticated RCE in EventLogServiceCollecto (ELSC): The ELSC gives an attacker the ability to run malicious scripts on all connected Diagnostics Agents since it lacks authentication and input sanitization. If the attack is successful, the attacker has total access to the system’s confidentiality, integrity, and availability. CVSS Score for corresponding CVE-2023-27497 is 10.

Unauthenticated RCE in OSCommand Bridge: The OSCommand Bridge’s lack of authentication and insufficient input validation allows an attacker with in-depth knowledge of the system to run malicious scripts on all associated Diagnostics Agents running on all supported Operating Systems. If the attack is effective, the system’s confidentiality, integrity, and availability will be compromised. CVSS Score for corresponding CVE-2023-27267 is 9.

The last to mention is Note 3298961 that covers the SAP BusinessObjects Business Intelligence Platform vulnerabilities – Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management), with a CVSS Score of 9.8. Anyone with minimal user privileges can access the lcmbiar file and further decrypt it. Depending on the BI user’s privileges and the attacker’s ability to get user credentials, the intruder may be able to take actions that will completely compromise the application.

Summary