Sensitive Information Disclosure in SAP Crystal Reports

vendor:

Crystal Reports for Visual Studio

by:

Mohamed M.Fouad

9.8

CVSS

CRITICAL

Information Disclosure

200

CWE

Product Name: Crystal Reports for Visual Studio

Affected Version From: SAP Crystal Reports for Visual Studio, Version - 2010

Affected Version To: SAP Crystal Reports for Visual Studio, Version - 2010

Patch Exists: YES

Related CWE: CVE-2019-0285

CPE: a:sap:crystal_reports_for_visual_studio

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10

2019

Sensitive Information Disclosure in SAP Crystal Reports

An information disclosure vulnerability exists in SAP Crystal Reports for Visual Studio, Version - 2010, which could allow an attacker to intercept the 'Export' report http request, copy the '__CRYSTALSTATE' + <crystal report user control> Viewer name parameter value, decode the base64 value and gain access to database information such as name, credentials, Internal Path disclosure and some debugging information.

Mitigation:

SAP recommends customers to apply the necessary patches as soon as possible.

Source

Exploit-DB raw data:

# Exploit Title: [Sensitive Information Disclosure in SAP Crystal Reports]
# Date: [2019-04-10]
# Exploit Author: [Mohamed M.Fouad - From SecureMisr Company]
# Vendor Homepage: [https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
# Version: [SAP Crystal Reports for Visual Studio, Version - 2010] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2019-0285]

POC:

1- Intercept the "Export" report http request

2- Copy the "__CRYSTALSTATE" + <crystal report user control> Viewer name parameter value. 

3- You will find a base64 value in "viewerstate" attribute. 

4- decode the value you will get database information such as: name, credentials, Internal Path disclosure and some debugging information.