Advisory
On 10.09.2024 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Commerce Cloud.
SAP Note 3430336 addresses "[CVE-2013-3587] Information Disclosure vulnerability in SAP Commerce Cloud" to prevent information disclosure with a medium risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as none, the team suggests.
Information disclosure is when an application fails to properly protect sensitive and confidential information from
parties that are not supposed to have access to the subject matter in normal circumstances.
Carefully review every information disclosure vulnerablity in regards to disclosure obligations post-GDPR for
‘Personal data’ under the Data Protection Act 2018.
Risk specification
SAP Commerce Cloud web app use Gzip HTTP Compression, that could expose it to BREACH attacks as per CVE-2013-3587 when specific conditions are met which is detailed in the following sections. This may lead to high impact on the confidentiality and no impact on the integrity and availability of the system.Solution
Spring Security has introduced XorCsrfTokenRequestAttributeHandler that protects anti-CSRF tokens against BREACH attacks by using random cryptographic nonces. SAP Commerce Cloud addresses this vulnerability by implementing XorCsrfTokenRequestAttributeHandler in web apps that use anti-CSRF tokens. The following patches contain the improved configuration: SAP Commerce Cloud Update Release 2211.18 (Preview of 2211.20) The Software Downloads of these or later patches are available in the SAP Support Portal: Software Downloads for the customers of SAP Commerce Cloud in the Public Cloud. For information about installing patches, see About Patch Releases. After installing a SAP Commerce Cloud patch, customers need to re-build and re-deploy the updated SAP Commerce Cloud version. Customers of SAP Commerce Cloud in Public Cloud should follow these build and deploy instructions. Remediation Steps for Custom Built Applications: If you have any custom web apps that have been built based on extensions provided in SAP Commerce Cloud 2211.17 or earlier, you are at risk of using potentially vulnerable anti-CSRF tokens. To ensure that your system is protected from BREACH attacks, implement XorCsrfTokenRequestAttributeHandler in your web apps. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "none".
- 7.5 [CVE-2020-26809] Information Disclosure in SAP Commerce Cloud
- 7.0 [CVE-2020-6295] Information Disclosure in SAP Adaptive Server Enterprise
- 6.5 Information Disclosure in Supplier Relationship Management
- 6.3 [CVE-2020-6297] Information Disclosure in SAP Data Intelligence
- 5.3 [CVE-2024-28163] Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)
