Please cearify 3421384 Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence

[Martin_4]

intentionaly empty

[Martin_4]

Suma Sum:

What is the  Excel Data Access Service for ?
In short:
-it enables You only to build a Webi on top of an Excel, loaded into the BO Content.
-it has no impact on downloading, exporting excels (or PDFs) with data from a BO Applications
-it has no impact on Webi Applcations on top of Excel, loaded into the BO Content, already build,
these still work with or without Excel Data Access Service

How to check Excel Data Access Service functionality
and / or build a BO Server without  Excel Data Access Service ?
-Logged in with SAP or Enterprise Authentification

A) Build a Test Case 
-upload an Excel to the BO Content Server,
-build a Webi Application on top of it and execute it,
-if You dont have an error while building, You have a Excel Data Access Service in one of the BO Servers,
-generating a Webi or a Lumira and exporting the results  to Excel or PDF is working

B)Find the BO Server with the Data Access Service "switched" on:
-Go to through all Your servers, an check the Common Services for Excel Data Access Service
For example: Adaptive Processing Server, M...14.APS.WebI,

C) Set up a BO server without ExcelData Access Service to see whats working not
-its in BO technically not possible to delete or remove an Excel Data Access Service in an existing BO Server,
-its also in BO technically not possible to delete or remove an Excel Data Access Service in a Clone of an  existing BO Server,
-you must make a new BO Server without of the Excel Data Access Service and than
 shutdown the existing BO Server (with the  Excel Data Access Service) (and best mark it as inactive).

D) Test You Excel BO Content based webi again
-with the (all) Excel Data Access Service not beeing active in a BO Server its not more possible to
build a Webi Application (or other) on top of an Excel loaded into the BO Content,
-Webi Creates an Error: Fehler im Server. Interner Fehler beim Aufruf von 'processDPCommandsEx' API. (Fehler: ERR_WIS_30270)

 -existing Webis, based on Excel in the BO Conetnt still run
-export of Excel in any BO Application still works

What does this mean for the 3421384 if You build a BO Server without of the Excel Data Access Service :
-Existing Webis on base of an Excel can still be used
-Export of an Webi Application to PDF or Excel is still possible
-You might face risks according to 3421384 in Your existing BO Content Excels
(what means these may contain code to read out the BO Server)

Replies (0)

[Martin_4 · Accepted solution]

intentionaly empty

[mauricio_bernardo · Accepted solution]

Hi Martin, I work as the SAP Support Enginner for SAP BI, and regarding your question, I ensure you to implement the fix as described in the note. If you choose to remove Excel services from the Adaptive Processing Servers (APSs) within the CMC > services section, you'll eliminate the vulnerability but also lose the associated functionality. To remove the service, stop each APS and edit the common services to remove the specified one. In a distributed system, ensure you check all APSs.

[BasicTek]

It's used for webi reports that are based of Excel as a data source vs SQL, BW, Oracle, etc

https://launchpad.support.sap.com/#/notes/1709797

[Martin_4]

Intentionaly empty

[BasicTek]

You are better off applying the fix as the note states, If you remove the Excel services from the APS(s) in the CMC > services > every Adaptive Processing Server that is hosting the service, then you will lose the functionality but no longer be vulnerable.

To remove the APS(s) must be stopped and edit the common services and remove the one specified. Make sure to check all APS(S) if you have a distributed system.

[Martin_4]

intentionaly empty