DOM-Based Cross-Site Scripting
SAP Business Objects
SAP BusinessObjects Web Intelligence - version 420
Bartosz Śmigielski (glasn0st)
SAP BusinessObjects version 420 is vulnerable to DOM-XSS attack. An attacker can inject a URL into the GET parameter, injecting scripts from the given URL into the application. To exploit the vulnerability, access to the application is not required as the attack vector is a GET parameter. However, to find the bug, a low privilege account might be needed.
Due to SAP disclosure guidelines (https://www.sap.com/documents/2022/02/9ccd9ca0-167e-0010-bca6-c68f7e60039b.html), we can't publish proof-of-concept yet. A full description of the finding will be disclosed in January 2024.
- 20-07-2023 - Vulnerability reported to vendor
- 24-07-2023 - First response from SAP
- 05-10-2023 - Vulnerability fixed during October patch day
- 10-10-2023 - Acknowledge from SAP on their website