SAP Solution Manager - Open Redirect

mediumseverity

6.1CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

SAP Solution Manager contains an open redirect vulnerability via the logoff endpoint. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

Attackers can redirect users to malicious websites through crafted links, potentially facilitating phishing attacks or credential theft.

Fix

Apply security patches or updates provided by SAP to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/sap/public/bc/icf/logoff?redirecturl=https://interact.sh
Positive when: status 302 or 301 or 307 AND contains in header "Location: https://www.interact.sh" or "Location: https://interact.sh"

Run it with nuclei: nuclei -id CVE-2020-26836 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-26836

info:
  name: SAP Solution Manager - Open Redirect
  author: Gal Nagli,LRVT
  severity: medium
  description: SAP Solution Manager contains an open redirect vulnerability via the logoff endpoint. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Attackers can redirect users to malicious websites through crafted links, potentially facilitating phishing attacks or credential theft.
  remediation: |
    Apply security patches or updates provided by SAP to fix the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-26836
    - https://onapsis.com/security-advisories/sap-solution-manager-open-redirect-trace-analysis/
    - http://packetstormsecurity.com/files/163136/SAP-Solution-Manager-7.2-ST-720-Open-Redirection.html
    - http://seclists.org/fulldisclosure/2021/Jun/25
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-26836
    cwe-id: CWE-601
    epss-score: 0.022
    epss-percentile: 0.82664
    cpe: cpe:2.3:a:sap:solution_manager:7.20:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sap
    product: solution_manager
  tags: cve,cve2020,redirect,sap,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/sap/public/bc/icf/logoff?redirecturl=https://interact.sh"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 302
          - 301
          - 307

      - type: word
        part: header
        words:
          - "Location: https://www.interact.sh"
          - "Location: https://interact.sh"
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from