PT-2017-14519 · Sap · Sap Hana Extended Application Services

Published 2017-12-12 · Updated 2023-12-21 · CVE-2017-16680

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP HANA extended application services version 1.0

Description The issue involves two potential audit log injections in SAP HANA extended application services. Firstly, certain HTTP/REST endpoints of the controller service lack user input validation, allowing unprivileged attackers to forge audit log lines and potentially hinder or misdirect the interpretation of audit log files. Secondly, the User Account and Authentication component writes audit logs into syslog and a log file, but the log file entries miss escaping, which could also hinder or misdirect the interpretation of audit log files, while the syslog entries remain correct.

Recommendations For SAP HANA extended application services version 1.0, consider implementing user input validation for the affected HTTP/REST endpoints of the controller service to prevent audit log line forgery. Additionally, ensure proper escaping of audit log entries in the log file to prevent misinterpretation. As a temporary workaround, consider restricting access to the affected log files until a patch is available.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-16680

Affected Products

Sap Hana Extended Application Services

References · 6

• https://launchpad.support.sap.com/#/notes/2522510 · Vendor Advisory
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16680 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16680 · Vendor Advisory
• http://securityfocus.com/bid/102138 · Note
• https://t.me/cvenotify/64602 · Telegram Post