CVE-2020-6308 PoC — SAP 多款产品代码问题漏洞

Source

https://github.com/MachadoOtto/sap_bo_launchpad-ssrf-timing_attack

Associated Vulnerability

Title:SAP 多款产品代码问题漏洞 (CVE-2020-6308)
Description:SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.

Description

This script exploits and performs an SSRF (Server-Side Request Forgery) and Timing Attack against the SAP BusinessObjects Launchpad (CVE-2020-6308). It attempts to determine the status of various ports on a target IP address by measuring the response time of the application when attempting to authenticate against it.

Readme

# SAP BusinessObjects Launchpad SSRF & Timing Attack PoC

This Python script is a proof-of-concept (PoC) for executing SSRF (Server-Side Request Forgery) and Timing Attacks against SAP BusinessObjects Launchpad. It is designed to help security researchers and professionals identify open ports on a target IP by leveraging SAP BusinessObjects' authentication mechanisms.

## Features

- **SSRF Exploit:** Leverages SSRF to interact with internal services by targeting different ports on a specified IP address.
- **Timing Attack:** Measures the time taken by the SAP BusinessObjects server to respond to authentication attempts, allowing you to infer the status of targeted ports.
- **Customizable Ports:** Allows you to specify a list of ports to target, or you can use the default set of common ports.

## Requirements

- Python 3.x

## Installation

Clone the repository and navigate to the project directory:

```bash
git clone https://github.com/MachadoOtto/sap_bo_launchpad-ssrf-timing_attack.git
cd sap_bo_launchpad-ssrf-timing_attack
```

## Usage

```bash
./sap_bo_launchpad-ssrf-timing_attack.py <affected_url> <targetIP> [targetPorts]
```

- `affected_url`: The URL of the SAP BusinessObjects Launchpad instance you want to test.
- `targetIP`: The IP address you want to probe for open ports.
- `targetPorts` (optional): A comma-separated list of ports to check (e.g., 22,80,443). If not specified, a default set of ports will be used.

##  Legal Disclaimer

This script is intended for educational purposes only and should only be used in environments where you have explicit permission to conduct security testing. Unauthorized use of this script against targets without consent is illegal and unethical.

File Snapshot


 [4.0K]  /data/pocs/fe91281dd060e26cf17906a90ba815eb4c5569f1
├── [1.0K]  LICENSE
├── [1.7K]  README.md
└── [2.5K]  sap_bo_launchpad-ssrf-timing_attack.py

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!