Multiple Denial of Service vulnerabilities in SBSPEXT_HTMLB

Impact on Business

By exploiting these vulnerabilities, an attacker, authenticated as a non-administrative user, has the ability to significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability.

Vulnerability Details

One page of the BSP Application HTMLB_SAMPLES, part of the package SBSPEXT_HTMLB, does not properly restrict the parameters it receives, leading to a situation that can be abused by a non-administrative user of the SAP system to consume all resources and trigger a denial of service. A non-administrative user could execute the following request, with certain parameters, multiple times, to lock all processing power of the application.

Solution

SAP has released SAP Note 3303060 which provides patched versions of the affected components.

The patches can be downloaded from https://me.sap.com/notes/3303060 

Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.

Report Timeline

• 01/25/2023: Onapsis reports vulnerability to SAP
• 04/11/2023: SAP issues the patch

References

• Onapsis blogpost: https://onapsis.com/blog/sap-patch-day-april-2023/ 
• CVE Mitre: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29185
• Vendor Patch: https://me.sap.com/notes/3303060