CVE-2024-41730

published 2024-08-13

CVE-2024-41730: In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token…

Priority P2 76 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

In SAP BusinessObjects Business Intelligence
Platform, if Single Signed On is enabled on Enterprise authentication, an
unauthorized user can get a logon token using a REST endpoint. The attacker can
fully compromise the system resulting in High impact on confidentiality,
integrity and availability.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sap	business_objects_business_intelligence_platform	—	—
sap	business_objects_business_intelligence_platform	—	—
sap_se	sap_businessobjects_business_intelligence_platform	—	—
sap_se	sap_businessobjects_business_intelligence_platform	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /biprws/logon/trusted

other X-SAP-TRUSTED-USER: administrator

snort

alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SAP BusinessObjects Business Intelligence Platform Authentication Bypass Attempt (CVE-2024-41730)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/biprws/logon/trusted"; http.header; content:"X-SAP-TRUSTED-USER|3a 20|administrator"; fast_pattern; reference:cve,2024-41730; reference:url,redrays.io/blog/critical-sap-businessobjects-authentication-vulnerability-cve-2024-41730/; reference:url,community.sap.com/t5/technology-blogs-by-members/poc-critical-authentication-vulnerability-in-sap-businessobjects-business/ba-p/13942037; classtype:attempted-admin; sid:2057778; rev:2; metadata:created_at 2024_11_22, cve CVE_2024_41730, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit uses HTTP GET method to the REST endpoint /biprws/logon/trusted to obtain a logon token without valid credentials when SSO (Single Sign-On) is enabled on Enterprise authentication.
• → The fast_pattern anchor for detection is the HTTP request header 'X-SAP-TRUSTED-USER: administrator' (hex-encoded colon+space: |3a 20|). Alert on any request carrying this header targeting the trusted logon endpoint.
• → Rule is recommended for Perimeter, Internal, and SSLDecrypt deployment contexts, indicating the attack may occur over TLS — SSL inspection is required for full coverage.
• → MITRE mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application. Treat detections as high-severity attempted admin compromise.

• · The vulnerability is only exploitable when Single Sign-On (SSO) is enabled on Enterprise authentication in SAP BusinessObjects BI Platform. Instances without SSO enabled are not affected by this specific attack vector. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862