External risk intelligence

SAP BusinessObjects BI Platform SSO Token Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-41730

SAP BusinessObjects Business Intelligence Platform is commonly deployed as a web-based enterprise application. The vulnerability resides in a REST endpoint used for authentication, which is typically accessible to users or systems interacting with the platform's web interface, making it a common target for network-based access in many business deployments.

Sap Business Objects Business Intelligence Platform

enterprise_430enterprise_440

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in SAP BusinessObjects Business Intelligence Platform that allows an unauthorized user to gain full system compromise, impacting confidentiality, integrity, and availability. This occurs when Single Sign-On is enabled, and an attacker exploits a REST endpoint to obtain a logon token.

Unauthorized access can lead to full system compromise.
This impacts critical business data and operations.
Confirm relevance and exposure of SAP BusinessObjects.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first accessing a specific REST endpoint. If Single Sign-On is enabled with Enterprise authentication, an unauthorized user can obtain a logon token without proper credentials. This token can then be used to gain full control of the system.

Unauthenticated access to a REST endpoint.
Single Sign-On enabled on Enterprise authentication.
Complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

When Single Sign-On is enabled on Enterprise authentication, an unauthorized user could obtain a logon token via a REST endpoint, potentially leading to a full system compromise affecting confidentiality, integrity, and availability.

Compromise of SAP BusinessObjects BI Platform.
Unauthorized access via REST endpoint.
Full system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in SAP BusinessObjects Business Intelligence Platform impacts confidentiality, integrity, and availability. Ownership likely falls to the platform or application team responsible for the SAP BusinessObjects deployment, in coordination with the security team for exposure assessment. The first practical step involves identifying all instances of the affected SAP BusinessObjects Business Intelligence Platform, confirming their accessibility and criticality, and then planning remediation based on the identified risk and business impact.

Platform or application team owns the issue.
Verify system accessibility and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SAP BusinessObjects Business Intelligence Platform?

It is an enterprise software suite designed for data reporting, visualization, and sharing across an organization. It functions as a centralized platform where businesses manage and distribute analytical insights, often serving as a web-based hub for users to interact with critical corporate data.

What does CWE-862 mean for CVE-2024-41730?

CWE-862 is the classification for Missing Authorization. In the context of this vulnerability, it means the software fails to verify if a user has permission to perform an action. Specifically, the system allows an unauthorized user to access a REST endpoint and receive a valid logon token, effectively bypassing the security controls that should have prevented access.

How is this REST endpoint vulnerability triggered?

The vulnerability is triggered when Single Sign-On is enabled on Enterprise authentication. An attacker sends a request to a specific REST endpoint to obtain a logon token without providing legitimate credentials. This flaw does not apply if Single Sign-On is disabled or if the system uses a different authentication configuration that does not involve this specific endpoint.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates a 'Likely' risk level because SAP BusinessObjects is frequently deployed as a web-based application. Since the vulnerability involves a REST endpoint typically used for platform interaction, it is a common target for network-based access. If your instance is accessible via the network, it faces a higher likelihood of being reachable by an unauthorized actor.

What should I do if I run SAP BusinessObjects?

First, locate and inventory all instances of the platform within your environment to understand your footprint. Coordinate between your application and security teams to verify if Single Sign-On is currently enabled with Enterprise authentication. Once you have identified affected systems, prioritize them for remediation based on their business criticality and network accessibility.

References

me.sap.com/notes/3479478

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.