Is CVE-2023-25617 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-25617 being exploited in the wild.

How severe is CVE-2023-25617?

High severity, with a CVSS score of 8.8, published 14 March 2023.

Which products and versions are affected?

sap-ai-sdk-base (PyPI) <= 3.3.0, ECOSYSTEM:introduced=0,last_affected=3.3.0, ECOSYSTEM:introduced=0,last_affected=420,last_affected=430; SAP BusinessObjects Business Intelligence Platform 420, 430.

Is there a fix for CVE-2023-25617?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-25617 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-25617?

Check whether you run sap-ai-sdk-base (PyPI) or SAP BusinessObjects Business Intelligence Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-25617: SAP Business Object OS command injection in Adaptive Job Server

Q: Is there a fix for CVE-2023-25617?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2023-25617 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2023-25617?

Check whether you run sap-ai-sdk-base (PyPI) or SAP BusinessObjects Business Intelligence Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-25617 · Severity: high · CVSS 8.8 · Published 2023-03-14

SAP Business Object and the SAP Cloud SDK for AI Python are vulnerable to a flaw that allows authorized users to run unauthorized commands on the underlying server. This occurs when the 'Program Objects Execution' feature is enabled, allowing a user with basic scheduling rights to potentially take full control of the system, access sensitive data, or disrupt operations. The issue primarily affects Unix-based installations of the Adaptive Job Server.

Technologies: SAP BusinessObjects Business Intelligence Platform. Vendors: PyPI, SAP.

Quick answers

Is CVE-2023-25617 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-25617 being exploited in the wild.
How severe is CVE-2023-25617?: High severity, with a CVSS score of 8.8, published 14 March 2023.
Which products and versions are affected?: sap-ai-sdk-base (PyPI) <= 3.3.0, ECOSYSTEM:introduced=0,last_affected=3.3.0, ECOSYSTEM:introduced=0,last_affected=420,last_affected=430; SAP BusinessObjects Business Intelligence Platform 420, 430.
Is there a fix for CVE-2023-25617?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-25617 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-25617?: Check whether you run sap-ai-sdk-base (PyPI) or SAP BusinessObjects Business Intelligence Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in SAP Business Object (Adaptive Job Server) versions 420 and 430, as well as the sap-ai-sdk-base Python package. The vulnerability is triggered when 'Program Objects Execution' is enabled. An authenticated attacker with scheduling privileges can exploit this via the BI Launchpad, Central Management Console, or custom applications using the public Java SDK to execute arbitrary commands on the host Unix system. This occurs due to improper neutralization of special elements used in OS commands. The attack vector is network-based with low complexity, requiring only low-level user privileges.

Affected products

SAP sap-ai-sdk-base <= 3.3.0
SAP Business Object (Adaptive Job Server) 420, 430

Identifiers

CVE-2023-25617
GHSA-xxhh-59gh-6ffx
PYSEC-2023-315

Timeline

2023-03-14: advisory: Initial publication of the advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.