CVE-2020-6308: SAP BusinessObjects Platform SSRF Vulnerability

CVE-2020-6308 Overview

CVE-2020-6308 is a Server-Side Request Forgery (SSRF) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Services) that allows unauthenticated attackers to inject arbitrary values as CMS parameters. This vulnerability enables attackers to perform lookups on internal networks that would otherwise be inaccessible externally, potentially leading to internal infrastructure discovery, remote file inclusion, server file retrieval, firewall bypass, and forcing the vulnerable server to execute malicious requests.

Critical Impact

Unauthenticated attackers can exploit this SSRF vulnerability to scan internal networks, map infrastructure, and leverage the compromised server as a pivot point for further attacks including remote file inclusion and firewall bypass.

Affected Products

• SAP BusinessObjects Business Intelligence Platform version 4.1 (410)
• SAP BusinessObjects Business Intelligence Platform version 4.2 (420)
• SAP BusinessObjects Business Intelligence Platform version 4.3 (430)

Discovery Timeline

• 2020-10-20 - CVE-2020-6308 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-6308

Vulnerability Analysis

This vulnerability exists in the Web Services component of SAP BusinessObjects Business Intelligence Platform. The flaw allows attackers to manipulate CMS (Central Management Server) parameters, causing the server to make arbitrary network requests on behalf of the attacker. Since the vulnerability requires no authentication, it presents a significant attack surface for external threat actors seeking to gain visibility into otherwise protected internal networks.

The exploitation of this SSRF vulnerability enables multiple attack scenarios. Attackers can enumerate internal services and infrastructure by forcing the server to connect to internal IP addresses and ports. The vulnerability also facilitates data exfiltration through server-side requests, allows bypassing of network access controls and firewalls, and can be chained with other vulnerabilities for remote file inclusion attacks.

Root Cause

The root cause of CVE-2020-6308 is inadequate input validation and sanitization of CMS parameters within the SAP BusinessObjects Web Services component. The application fails to properly restrict or validate user-supplied input used in server-side HTTP requests, allowing attackers to inject arbitrary destination URLs and IP addresses. This CWE-918 (Server-Side Request Forgery) vulnerability stems from trusting user input without implementing proper allow-listing or URL validation mechanisms.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests to the SAP BusinessObjects Web Services endpoint, injecting arbitrary values into CMS parameters. These parameters are then used by the server to perform internal lookups and network requests.

The exploitation flow typically involves identifying exposed SAP BusinessObjects Web Services endpoints, crafting requests with manipulated CMS parameters containing internal IP addresses or hostnames, analyzing server responses to determine which internal hosts and services are reachable, and iterating through IP ranges and port numbers to map the internal network topology.

Detection Methods for CVE-2020-6308

Indicators of Compromise

• Unusual outbound connection attempts from SAP BusinessObjects servers to internal network ranges
• Web Services requests containing internal IP addresses or RFC 1918 private address ranges in CMS parameters
• Increased volume of requests to SAP BusinessObjects Web Services endpoints from external sources
• Server-side requests to cloud metadata endpoints (e.g., 169.254.169.254)

Detection Strategies

• Monitor SAP BusinessObjects Web Services logs for requests containing suspicious CMS parameter values
• Implement network-level detection for outbound connections from application servers to unexpected internal destinations
• Deploy web application firewall (WAF) rules to detect and block SSRF patterns in request parameters
• Analyze HTTP request logs for sequential IP address scanning patterns originating from the application server

Monitoring Recommendations

• Enable detailed logging for SAP BusinessObjects Web Services and CMS communication
• Configure SIEM alerts for anomalous outbound network connections from SAP application servers
• Implement egress filtering monitoring to detect unauthorized internal network scanning activity
• Review access logs for unauthenticated requests to Web Services endpoints

How to Mitigate CVE-2020-6308

Immediate Actions Required

• Apply the security patch referenced in SAP Security Note #2943844 immediately
• Implement network segmentation to limit what internal resources the SAP BusinessObjects server can access
• Configure web application firewall rules to block requests containing internal IP addresses in parameters
• Restrict outbound network connectivity from SAP BusinessObjects servers to only required destinations

Patch Information

SAP has released a security update addressing this vulnerability. Administrators should apply the patch documented in SAP Security Note #2943844. Additional information about this security update is available in the SAP Wiki Page Overview. Organizations should prioritize patching given the high EPSS score of 82.056% indicating significant likelihood of exploitation attempts.

Workarounds

• Implement strict egress filtering to prevent the SAP BusinessObjects server from initiating connections to internal network ranges
• Deploy a reverse proxy with SSRF protection capabilities in front of the Web Services endpoint
• Use network access control lists (ACLs) to restrict which internal resources the application server can communicate with
• Consider temporarily disabling the affected Web Services functionality if not business-critical until patching is complete

# Example network-level mitigation using iptables to restrict outbound connections
# Block outbound connections to private IP ranges from SAP BO server
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner sapbo -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner sapbo -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner sapbo -j DROP
# Block metadata endpoint access
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner sapbo -j DROP