Product<\/strong>: SAP Fiori Sample Shop
Affected Version<\/strong>: Docker Image sapse\/abap-platform-trial:1909
Vulnerability Type<\/strong>: CWE-284 (Improper Access Control)
Security Risk<\/strong>: MEDIUM - CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:L
Vendor URL<\/strong>: https:\/\/www.sap.com\/<\/a>
Vendor Status<\/strong>: Fixed
CVE number<\/strong>: Not assigned
Last Update<\/strong>: 2024-03-18<\/p>\n
Affected Component<\/h3>\n
SAP Trial docker container with pre-configured SAP Fiori Sample Shop<\/p>\n
Description<\/h3>\n
SAP Fiori is the SAP webfrontend which can host various applications from an application store or custom applications, which can be built with SAP ABAP.
When using the application, backend requests are sent to an OData API.
If API permissions differ from the configuration applied to the frontend component, attackers may execute backend functionality without authorization granted in the frontend.<\/p>\n
Proof of Concept<\/h3>\n
The preconfigured shop contains several pieces of sample data. For our PoC we pick a random product from the shop. In the product overview in the upper right corner, we can write a review, as can be seen in the following screenshot:![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/03\/write_review.png\")
At the bottom all reviews are displayed. As can be seen in the following screenshot, only our own reviews have an associated delete button:<\/p>\n
![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2024\/03\/own_review.png\")
<\/p>\n
The following request will be sent to the OData backend API by clicking the frontend's delete button on our own review:<\/p>\n
DELETE \/sap\/opu\/odata\/sap\/SEPMRA_SHOP\/Reviews(guid'0242ac11-0002-1eee-9792-6efba254d650')?sap-client=001 HTTP\/1.1sap-contextid-accept: headerAccept: application\/jsonAccept-Language: enDataServiceVersion: 2.0MaxDataServiceVersion: 2.0x-csrf-token: nK8sL23VXwnBlSOaso7TXg==<\/pre>\nIntercepting this requst allows us to resend it with other guids placed in the request. Thereby we can delete other user's reviews.<\/p>\n
The necessary guids can be enumerated by sending the following request:<\/p>\n
GET \/sap\/opu\/odata\/sap\/SEPMRA_SHOP\/Reviews?sap-client=001 HTTP\/1.1sap-contextid-accept: headerAccept: application\/jsonAccept-Language: enDataServiceVersion: 2.0MaxDataServiceVersion: 2.0<\/pre>\nFix<\/h3>\n
It is recommended to restrict access to sensitive functions or information by default.
Required access privileges should be granted explicitly by a global access control mechanism, which should be consistent regardless whether the backend is accessed via the application's frontend or API.<\/p>\nReferences<\/h3>\n
https:\/\/cwe.mitre.org\/data\/definitions\/284.html<\/a>
https:\/\/owasp.org\/Top10\/A01_2021-Broken_Access_Control\/<\/a><\/p>\nTimeline<\/h3>\n
\n
- 2023-10-04<\/strong>: Vulnerability identified by Ole Wagner of usd AG.<\/li>\n
- 2023-10-05<\/strong>: First contact request via SAP's vulnerability disclosure form.<\/li>\n
- 2023-10-25<\/strong>: Received an update by SAP that the incident is in internal review.<\/li>\n
- 2023-11-14<\/strong>: The vulnerability was confirmed by SAP's security team and the vulnerable sample application was removed from the trial version.<\/li>\n
- 2024-03-26:<\/strong> This advisory is released by usd AG.<\/li>\n<\/ul>\n
Credits<\/h3>\n
This security vulnerability was identified by Ole Wagner of usd AG.<\/p>\n
[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2023-0038 | Broken Access Control in SAP Fiori Sample Shop Advisory ID: usd-2023-0038Product: SAP Fiori Sample ShopAffected Version: Docker Image sapse\/abap-platform-trial:1909Vulnerability Type: CWE-284 (Improper Access Control)Security Risk: MEDIUM - CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:LVendor URL: https:\/\/www.sap.com\/Vendor Status: FixedCVE number: Not assignedLast Update: 2024-03-18 Affected Component SAP Trial docker container with pre-configured SAP Fiori Sample Shop Description SAP Fiori is […]<\/p>\n","protected":false},"author":114,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-22420","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/114"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=22420"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22420\/revisions"}],"predecessor-version":[{"id":22474,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/22420\/revisions\/22474"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=22420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}