SAP Crystal Reports Server Multiple Vulnerabilities

Bugtraq ID:	45980
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2011 12:00AM
Updated:	Jan 14 2011 12:00AM
Credit:	Dmitry Chastuhin
Vulnerable:	SAP Crystal Reports Server 2008 0
Not Vulnerable:

SAP Crystal Reports Server Multiple Vulnerabilities

SAP Crystal Reports Server is prone to multiple cross-site scripting vulnerabilities and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

The cross-site scripting issues can be exploited to execute script code in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials. The directory-traversal issue can be exploited to disclose the contents of arbitrary files.

SAP Crystal Reports Server 2008 is vulnerable.

SAP Crystal Reports Server Multiple Vulnerabilities

An attacker can exploit a directory-traversal issue using a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

The following example URI is available:

http://www.example.com:8080/PerformanceManagement/jsp/qa.jsp?func=browse&root=wi&path=../../../../../../boot.ini

SAP Crystal Reports Server Multiple Vulnerabilities

Solution:
Vendor patches are available. Please see the references for more information.

SAP Crystal Reports Server Multiple Vulnerabilities

References:

• [DSECRG-11-001] SAP Crystal Reports 2008 - actionNavjsp_xss (Digital Security Research Group)
  
• [DSECRG-11-003] SAP Crystal Reports 2008 - Directory Traversal (Digital Security Research Group)
  
• Crystal Reports Server Homepage (SAP)
  
• SAP Security Notes (SAP)
  
• SAP Security Notes (SAP)