CVE-2024-41730

What it actually does

CVE-2024-41730 is an authentication and authorization bypass in SAP BusinessObjects Business Intelligence Platform. When Single Sign-On is enabled for Enterprise authentication, an unauthenticated remote attacker can abuse a REST endpoint to obtain a valid logon token without legitimate credentials. Because SAP BusinessObjects logon tokens can be used to access BI platform APIs and application functions as an authenticated user, successful exploitation can lead to full compromise of confidentiality, integrity, and availability, including unauthorized access to reports, universes, schedules, repository objects, administrative functions, and potentially downstream data sources reachable through the BI platform.

Why it matters to the business

A successful attack can allow an external or internal unauthenticated attacker to take over the BusinessObjects environment, access sensitive business reports, alter or delete BI content, disrupt reporting operations, and potentially pivot into connected data platforms. The CVSS score is critical at 9.8 and the EPSS score is high at approximately 0.76, meaning exploitation is considered likely even though it is not currently listed in CISA KEV. Organizations that expose SAP BusinessObjects REST services to untrusted networks should treat this as urgent because exploitation requires no credentials, no user interaction, and low technical complexity.

How an attack unfolds

An attacker first identifies an exposed SAP BusinessObjects Business Intelligence Platform instance with REST services enabled, commonly by probing BusinessObjects web paths and REST endpoints. If the target is configured with Single Sign-On enabled on Enterprise authentication, the attacker sends a crafted unauthenticated request to the vulnerable REST endpoint responsible for logon token handling. Due to improper authorization enforcement, the platform issues a valid logon token even though the requester has not authenticated. The attacker then reuses that token against BusinessObjects REST APIs or web application functions to act as an authenticated session. From there, the attacker can enumerate repository content, access reports and documents, modify schedules or BI objects, create or alter accounts if privileges allow, disrupt services, and extract sensitive data available through the platform.

How to fix it

Apply the relevant SAP Security Note and vendor-supported patch for SAP BusinessObjects Business Intelligence Platform that remediates CVE-2024-41730. Because no exact fixed versions were provided in the input, administrators should consult SAP’s official August 2024 Security Patch Day guidance and the SAP Support Portal for the affected BI Platform release and support package level. If immediate patching is not possible, restrict access to BusinessObjects REST endpoints, especially biprws/logon-related endpoints, to trusted networks only; place the application behind VPN or identity-aware access controls; disable unnecessary REST services; review whether SSO on Enterprise authentication is required; and enforce network-layer controls to prevent anonymous access from untrusted sources. Rotate or invalidate active BusinessObjects logon tokens and review privileged accounts after patching if exposure is suspected.

How to confirm the fix worked

Confirm the installed SAP BusinessObjects BI Platform version and patch level match the vendor-fixed release or support package. Verify that unauthenticated requests to REST logon or token endpoints cannot obtain a valid logon token. Test from an unauthenticated network location and ensure requests to BusinessObjects REST APIs require valid authentication and fail closed with 401, 403, or equivalent denial responses. Review configuration to confirm SSO and Enterprise authentication settings are expected and that REST endpoints are not exposed beyond intended trust boundaries. Validate reverse proxy, load balancer, and firewall rules to ensure BusinessObjects administrative and REST paths are not reachable from the public internet unless explicitly required and protected.

Typical attack path

1. Discover an internet-facing or internally reachable SAP BusinessObjects BI Platform instance.
2. Probe BusinessObjects web and REST service paths such as BOE and biprws endpoints.
3. Confirm that REST logon/token functionality is reachable and that Enterprise authentication with SSO is enabled.
4. Send a crafted unauthenticated request to the vulnerable REST endpoint to obtain a logon token.
5. Use the returned token in subsequent API or application requests as an authenticated session token.
6. Enumerate users, groups, folders, reports, universes, schedules, and other BI repository objects.
7. Access or export sensitive reports and data available through the compromised BI platform.
8. Modify, delete, or schedule BI content, or attempt administrative actions to maintain access and expand impact.

How to detect it

Investigate SAP BusinessObjects application logs, web server access logs, reverse proxy logs, load balancer logs, WAF logs, and SIEM authentication telemetry for unauthenticated requests to BusinessObjects REST logon or token endpoints that return successful responses. Pay particular attention to requests to biprws logon paths from unfamiliar IP addresses, internet sources, scanners, or hosts that do not normally use BI APIs. Look for successful logon token issuance without a corresponding normal authentication flow, unusual use of Enterprise authentication, REST API calls immediately after anonymous logon/token requests, and large volumes of report, folder, document, universe, or schedule enumeration. For forensic review, correlate source IP, user agent, session identifiers, issued logon tokens where logged, requested endpoints, response codes, and subsequent object access. Also review BusinessObjects audit data for unusual logon events, administrative changes, report exports, schedule modifications, deleted objects, new users or groups, privilege changes, and activity outside business hours.

• /biprws/logon
• /biprws/logon/long
• /biprws/logon/token
• /biprws/v1/logon
• /BOE/BI
• X-SAP-LogonToken
• logonToken
• secEnterprise
• POST /biprws/logon
• POST /biprws/logon/long
• GET /biprws/logon/token
• 401 /biprws/logon
• 200 /biprws/logon
• 200 /biprws/logon/long
• 200 /biprws/logon/token

What your security team should do

• Prioritize patching SAP BusinessObjects BI Platform because the issue is unauthenticated, remotely exploitable, critical severity, and has a high EPSS likelihood score.
• Inventory all SAP BusinessObjects BI Platform deployments, including internal-only instances, and identify those exposing BOE or biprws REST endpoints.
• Restrict network access to BusinessObjects REST services immediately if patching cannot be completed quickly.
• Review whether Single Sign-On with Enterprise authentication is enabled and disable or harden it where not operationally required.
• Search logs for unauthenticated or anomalous access to logon/token REST endpoints, especially followed by successful API activity from the same source IP.
• Invalidate active sessions or logon tokens after remediation if suspicious token issuance is observed.
• Review BusinessObjects users, groups, scheduled jobs, publications, reports, universes, and administrative changes for unauthorized modifications.
• Monitor for bulk report export, unusual document access, failed-to-successful authentication patterns, and REST API enumeration after token issuance.
• Ensure SAP BusinessObjects is not directly exposed to the internet unless protected by strong upstream authentication, allowlisting, and monitoring.