The August 2020 SAP Security Notes address several critical vulnerabilities across SAP Knowledge Management, NetWeaver AS JAVA, and BusinessObjects Business Intelligence. These patches mitigate risks including unauthorized code execution, broken authentication, and potential denial-of-service attacks, requiring immediate attention from security administrators to secure SAP environments.
Executive Summary
In August 2020, SAP released a series of security advisories aimed at patching vulnerabilities that could compromise system integrity and data confidentiality. The most critical updates center on SAP Knowledge Management (KM), where vulnerabilities allowed for unauthorized code execution and file uploads. By disabling the “Force Text Download” parameter and applying relevant patches, organizations can prevent the exploitation of malicious scripts stored within KM repositories.
Beyond Knowledge Management, the updates address critical flaws in SAP NetWeaver AS JAVA and SAP BusinessObjects Business Intelligence. These include a denial-of-service vulnerability triggered by missing authentication checks and a security flaw in the Unix Xvfb daemon that could allow attackers to capture sensitive screen or keystroke data. Additionally, the release introduced stricter authorization checks for report RSBDCREC to prevent malicious code injection during recordings. Security teams should prioritize applying these notes to mitigate the risk of unauthorized access and system exploitation.
Key Takeaways
- Patch SAP Knowledge Management: Apply updates to mitigate critical code execution and broken authentication vulnerabilities.
- Disable Force Text Download: Disabling this WebDAV parameter prevents the automatic execution of malicious scripts.
- Secure SAP NetWeaver: Patch missing authentication checks to prevent potential denial-of-service attacks.
- Protect Xvfb Daemons: Mitigate keystroke and screen capture risks in SAP BusinessObjects Business Intelligence environments.
- Restrict RSBDCREC Access: Enable new authorization checks to prevent code injection via SAP report recordings.
What are the critical vulnerabilities in SAP Knowledge Management?
The August 2020 updates address two primary vulnerabilities in SAP Knowledge Management (KM) that could lead to unauthorized code execution and repository access. Note 2928635 patches a critical code execution flaw where KM supports the automatic execution of potentially malicious scripts in stored files. Administrators should disable the “Force Text Download” parameter—a WebDAV protocol feature—to remove this risk. Additionally, note 2938162 resolves a broken authentication vulnerability that previously allowed unauthenticated users to upload files directly to content repositories.
How do I secure SAP reports against code injection?
Security for report RSBDCREC has been enhanced to prevent the injection of malicious code during transaction recordings. Note 2941667 introduces mandatory authorization checks when the report is executed without transaction SHDB. This update extends checks for the authorization object SBDCMONI to the report and adds new checks for the SDEVELOP authorization object, ensuring that only authorized users can perform these sensitive operations.
What security risks affect SAP NetWeaver and BusinessObjects?
SAP NetWeaver AS JAVA and SAP BusinessObjects Business Intelligence were both subject to vulnerabilities involving missing authentication checks. Note 2941315 patches a web service vulnerability in SAP NetWeaver AS JAVA that could be exploited to provoke a denial of service. Furthermore, note 2927956 mitigates a missing authentication check for the Unix Xvfb daemon. This specific flaw is significant because it could enable attackers to capture keystrokes and screen data from the X server on SAP hosts.
FAQ
What is the “Force Text Download” parameter?
Force Text Download is a parameter of the WebDAV Protocol used in SAP Knowledge Management. When active, it can allow the automatic execution of potentially malicious scripts stored in files. SAP recommends disabling this parameter to prevent unauthorized code execution.
How does the Malicious Script Filter work?
The Malicious Script Filter is used to encode executable scripts found in files uploaded to KM repositories, preventing their execution. Encoded scripts can subsequently be decoded and managed using the Malicious Script Handler.
Why are authorization checks being added to report RSBDCREC?
Authorization checks were added to RSBDCREC to prevent attackers from exploiting the report to inject malicious code during recordings. By requiring SBDCMONI and S_DEVELOP authorization objects, SAP limits access to this sensitive functionality.