How to remediate – SAP BusinessObjects Business Intelligence Platform 4.1 < 4.1 S...

1. Introduction

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence tools used for reporting, data analysis and visualisation. This vulnerability affects versions prior to 4.1 SP12 P9, 4.2 SP8 P5 or 4.2 SP9 P0. Successful exploitation could allow an attacker to inject malicious JavaScript code into applications viewed by other users, leading to Stored Cross-Site Scripting (XSS). This impacts the confidentiality of user data and potentially the integrity of the system.

2. Technical Explanation

The vulnerability is caused by insufficient input validation in the custom value input field of an Input Control within SAP BusinessObjects Business Intelligence Platform. An authenticated attacker can inject malicious JavaScript code into this field, which will then be executed when other users view content containing that control. The Nessus scanner identifies vulnerable systems based on their self-reported version number and does not attempt exploitation.

• Root cause: Missing input validation for the custom value input field of an Input Control.
• Exploit mechanism: An attacker injects a malicious JavaScript payload into the custom value input field, which is then stored and executed when another user views the affected application content. For example, injecting `` could display an alert box.
• Scope: SAP BusinessObjects Business Intelligence Platform versions prior to 4.1 SP12 P9, 4.2 SP8 P5 or 4.2 SP9 P0 on Windows hosts.

3. Detection and Assessment

Confirming vulnerability requires checking the installed version of SAP BusinessObjects Business Intelligence Platform. A quick check can be done through the application’s interface, while a thorough method involves reviewing the system information.

• Quick checks: Log into the Central Management Console and navigate to Administration > Server Intelligence. The platform version will be displayed there.
• Scanning: Nessus vulnerability ID CVE-2021-21447 can identify affected systems, but relies on accurate self-reporting by the application.
• Logs and evidence: Review SAP BusinessObjects logs for any unusual input or script activity related to Input Controls. Specific log paths vary depending on configuration.

version - displays the installed version of SAP BusinessObjects Business Intelligence Platform

4. Solution / Remediation Steps

The following steps detail how to remediate this XSS vulnerability by applying a patch or upgrading the platform.

4.1 Preparation

• Ensure you have access to the necessary installation media or download links for the patch or upgrade. A roll back plan involves restoring from backup or reverting the virtual machine snapshot.
• A change window may be required, depending on service impact. Approval should be obtained from the relevant IT stakeholders.

4.2 Implementation

1. Step 1: Download and install SAP BusinessObjects Business Intelligence Platform patch SP12 P9 for version 4.1, or SP8 P5/SP9 P0 for version 4.2 from the official SAP Support Portal.
2. Step 3: Verify that the patch has been applied successfully by checking the platform version in the Central Management Console (Administration > Server Intelligence).

4.3 Config or Code Example

Before

//Example of vulnerable Input Control configuration with no input validation
InputControl.AllowCustomValues = true;

After

//Example of secure Input Control configuration with input validation enabled
InputControl.AllowCustomValues = false; //Or implement robust sanitisation and encoding.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent XSS vulnerabilities like this one. Least privilege limits the impact of a successful attack, while input validation prevents malicious code from being injected in the first place. Safe defaults reduce the risk of misconfiguration.

• Practice 1: Implement least privilege for all user accounts to limit the potential damage caused by an exploited XSS vulnerability.
• Practice 2: Enforce strict input validation on all user-supplied data, including custom values in Input Controls, to block potentially malicious scripts.

4.5 Automation (Optional)

If you use configuration management tools, you can automate the patch installation process. The following is an example PowerShell script:

# Example PowerShell script for patching SAP BusinessObjects (requires appropriate permissions and access to installation files)
# This is a simplified example and may need adjustments based on your environment.
Start-Process -FilePath "C:PatchInstaller.exe" -ArgumentList "/silent /install" -Wait
Write-Host "SAP BusinessObjects patch installation started..."

5. Verification / Validation

Confirm the fix by verifying the installed version and re-running the vulnerability scan. A smoke test should confirm core functionality remains operational.

• Post-fix check: Log into the Central Management Console (Administration > Server Intelligence) and verify that the platform version is now 4.1 SP12 P9, 4.2 SP8 P5 or higher.
• Re-test: Re-run the Nessus scan with vulnerability ID CVE-2021-21447 to confirm it no longer detects the issue.
• Smoke test: Verify that users can still log in and access reports as expected. Confirm data analysis functions are working correctly.
• Monitoring: Monitor SAP BusinessObjects logs for any errors or unusual activity related to Input Controls. Example query: search for “XSS” or “script” within the relevant log files.

version - displays the installed version of SAP BusinessObjects Business Intelligence Platform (should be 4.1 SP12 P9 or higher)

6. Preventive Measures and Monitoring

Regularly update security baselines to include known vulnerabilities like this one. Implement checks in your CI/CD pipelines to prevent vulnerable code from being deployed. A sensible patch review cycle should be established based on the risk profile of the system.

• Baselines: Update your security baseline or policy to require SAP BusinessObjects versions 4.1 SP12 P9, 4.2 SP8 P5 or higher.
• Pipelines: Add Static Application Security Testing (SAST) tools to your CI/CD pipeline to identify potential XSS vulnerabilities in custom code.
• Asset and patch process: Review and apply security patches for SAP BusinessObjects at least every month, or sooner if a critical vulnerability is identified.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Patch installation may temporarily interrupt SAP BusinessObjects services. Schedule patching during a maintenance window to minimize impact.

8. References and Resources

Links to official advisories and trusted documentation are provided below for further information on this vulnerability and its