1. Introduction
SAP BusinessObjects Business Intelligence Platform is affected by a cross-site scripting vulnerability (XSS), identified as 3251447. This allows an attacker to inject malicious scripts into the application, potentially compromising user data and system integrity. Systems running Web Intelligence are usually affected. Successful exploitation can lead to limited impact on confidentiality and integrity of the application.
2. Technical Explanation
The vulnerability occurs because versions of SAP BusinessObjects Business Intelligence Platform prior to 4.2 SP9 P11 return JSON data with an incorrect content type header in responses from Web Intelligence. This allows a custom application directly calling Web Intelligence DHTML JSPs to be vulnerable to XSS attacks. The CVE identifier for this issue is CVE-2023-0015.
- Root cause: Incorrect content type header when returning JSON data from the Web Intelligence user interface.
- Exploit mechanism: An attacker crafts a malicious script and sends it to the vulnerable application via a direct call to a Web Intelligence JSP, exploiting the misconfigured content type. For example, an attacker could inject JavaScript code into a request that is then executed by a victim’s browser.
- Scope: SAP BusinessObjects Business Intelligence Platform versions prior to 4.2 SP9 P11 running on Windows hosts.
3. Detection and Assessment
- Quick checks: Check the application’s self-reported version number through the Web Intelligence user interface.
- Scanning: Nessus signature 18f404d5 can detect this vulnerability, but relies on reported version numbers only.
- Logs and evidence: Review SAP BusinessObjects logs for unusual requests to Web Intelligence JSPs. Specific log files will vary depending on configuration.
{insert a command or script that confirms exposure}4. Solution / Remediation Steps
Fixing the issue requires updating SAP BusinessObjects Business Intelligence Platform.
4.1 Preparation
- Ensure you have access to the necessary installation media and licenses. A roll back plan involves restoring from the pre-update backup/snapshot.
- A change window may be required, depending on your environment. Approval should be obtained from relevant IT stakeholders.
4.2 Implementation
- Step 1: Download the latest SAP BusinessObjects Business Intelligence Platform patch or service pack (version 4.2 SP9 P11 or later) from the SAP Support Portal.
- Step 2: Stop all SAP BusinessObjects services.
- Step 3: Install the downloaded patch or service pack following the vendor’s instructions.
- Step 4: Start all SAP BusinessObjects services.
4.3 Config or Code Example
Before
After
4.4 Security Practices Relevant to This Vulnerability
List only practices that directly address this vulnerability type. Use neutral wording and examples instead of fixed advice. For example: least privilege, input validation, safe defaults, secure headers, patch cadence.
- Practice 1: Implement a regular patch management process to ensure timely application of security updates.
- Practice 2: Enforce the principle of least privilege for all users and services accessing SAP BusinessObjects Business Intelligence Platform.
4.5 Automation (Optional)
5. Verification / Validation
Confirming the fix involves verifying the updated version of SAP BusinessObjects Business Intelligence Platform and performing a basic smoke test.
- Post-fix check: Check the application’s self-reported version number through the Web Intelligence user interface; it should now show 4.2 SP9 P11 or later.
- Re-test: Re-run Nessus scan 18f404d5 to confirm the vulnerability is no longer detected.
- Smoke test: Verify that users can still log in and access basic reports through Web Intelligence.
- Monitoring: Monitor SAP BusinessObjects logs for any errors related to the update or unexpected behaviour.
6. Preventive Measures and Monitoring
Suggest only measures that are relevant to the vulnerability type. Use “for example” to keep advice conditional, not prescriptive.
- Baselines: Update your security baseline to include a requirement for SAP BusinessObjects Business Intelligence Platform version 4.2 SP9 P11 or later.
- Pipelines: Integrate SAST tools into the CI/CD pipeline to identify potential XSS vulnerabilities in custom applications interacting with Web Intelligence.
- Asset and patch process: Implement a quarterly review cycle for SAP BusinessObjects patches and configurations.
7. Risks, Side Effects, and Roll Back
- Risk or side effect 1: The update process may cause temporary downtime for SAP BusinessObjects services.
- Roll back: 1) Stop all SAP BusinessObjects services. 2) Restore from the pre-update backup/snapshot. 3) Start all SAP BusinessObjects services.
8. References and Resources
- Vendor advisory or bulletin: https://launchpad.support.sap.com/#/notes/3251447
- NVD or CVE entry: CVE-2023-0015
- Product or platform documentation relevant to the fix: No additional links available.