CVE-2023-28765: SAP BusinessObjects Information Disclosure

CVE-2023-28765 Overview

CVE-2023-28765 is a critical information disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management). An attacker with basic privileges can gain access to the lcmbiar file and subsequently decrypt it. This decryption enables the attacker to extract BI user passwords, and depending on the privileges of the compromised BI user accounts, the attacker can perform operations that may completely compromise the application.

Critical Impact

This vulnerability allows attackers with minimal access to extract sensitive credentials from BusinessObjects configuration files, potentially leading to complete application compromise and unauthorized access to business intelligence data.

Affected Products

• SAP BusinessObjects Business Intelligence Platform version 420
• SAP BusinessObjects Business Intelligence Platform version 430
• SAP BusinessObjects Business Intelligence (Promotion Management component)

Discovery Timeline

• April 11, 2023 - CVE-2023-28765 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-28765

Vulnerability Analysis

This vulnerability stems from improper protection of sensitive data within the SAP BusinessObjects Business Intelligence Platform's Promotion Management component. The lcmbiar file, which contains encrypted user credentials and configuration data, can be accessed by users with only basic privileges. The encryption mechanism protecting this file is insufficient, allowing attackers to decrypt the contents and extract plaintext passwords for BI users.

The exploitation chain enables privilege escalation based on the compromised accounts. If the extracted credentials belong to administrative or high-privilege users, the attacker gains the ability to perform privileged operations across the entire BusinessObjects environment. This could include accessing sensitive business reports, modifying dashboards, extracting confidential data, or manipulating business intelligence workflows.

Root Cause

The root cause of CVE-2023-28765 is inadequate access control combined with weak cryptographic protection of sensitive configuration files. The Promotion Management component stores user credentials in the lcmbiar file format but fails to properly restrict access to this file based on user privilege levels. Additionally, the encryption scheme used to protect the file contents is vulnerable to decryption attacks, allowing authenticated users with basic access to recover the protected credentials.

Attack Vector

The attack is network-accessible and requires the attacker to have basic authenticated access to the SAP BusinessObjects platform. The attack sequence involves:

1. An attacker authenticates to the SAP BusinessObjects Business Intelligence Platform with minimal privileges
2. The attacker navigates to or programmatically accesses the Promotion Management component
3. The attacker retrieves the lcmbiar file containing encrypted user credentials
4. Using weaknesses in the encryption implementation, the attacker decrypts the file contents
5. The attacker extracts BI user passwords from the decrypted data
6. Depending on the privileges of the compromised accounts, the attacker can escalate access and perform operations that may fully compromise the application

The vulnerability requires no user interaction and can be exploited remotely over the network by any authenticated user with basic platform access.

Detection Methods for CVE-2023-28765

Indicators of Compromise

• Unusual access patterns to lcmbiar files or Promotion Management components by low-privilege users
• Multiple failed or successful authentication attempts using different BI user accounts from the same source
• Unexpected export or download activities involving Promotion Management archives
• Access to administrative functions by previously low-privilege accounts

Detection Strategies

• Monitor and alert on access to Promotion Management files and archives by users without explicit administrative needs
• Implement file integrity monitoring on BusinessObjects configuration directories
• Configure SIEM rules to detect rapid authentication attempts across multiple BI user accounts
• Review access logs for the Promotion Management component for anomalous patterns

Monitoring Recommendations

• Enable detailed audit logging for the SAP BusinessObjects platform, particularly for Promotion Management operations
• Configure alerts for privilege escalation events where users suddenly gain access to restricted reports or dashboards
• Monitor network traffic for bulk data exports from the BusinessObjects environment
• Regularly review user privilege assignments and compare against baseline configurations

How to Mitigate CVE-2023-28765

Immediate Actions Required

• Apply the security patch referenced in SAP Security Note #3298961 immediately
• Review and restrict access permissions to the Promotion Management component to only authorized administrators
• Audit all user accounts with access to BusinessObjects and remove unnecessary privileges
• Reset passwords for all BI user accounts as a precautionary measure

Patch Information

SAP has released a security patch to address this vulnerability. Organizations should apply the fix documented in SAP Security Note #3298961. The patch addresses the improper access control and strengthens the encryption mechanism protecting the lcmbiar files. For additional security guidance, refer to the SAP Document on Security.

Workarounds

• Restrict network access to the SAP BusinessObjects platform to trusted IP ranges only
• Implement additional access controls at the network layer to limit who can reach the Promotion Management component
• Use monitoring solutions to detect and alert on suspicious access to configuration files
• Consider temporarily disabling the Promotion Management feature until the patch can be applied

# Example: Restrict access to BusinessObjects Promotion Management directories
# Apply appropriate file system permissions (adjust paths for your environment)
chmod 700 /opt/sap/businessobjects/promotion_management/
chown -R bobj_admin:bobj_admin /opt/sap/businessobjects/promotion_management/