SAP applications are getting compromised by skilled attackers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-5326 | Unauthenticated Remote Code Execution in SAP NetWeaver Invoker Servlet The Invoker Servlet in SAP NetWeaver Application Server (AS) Java does not require authentication, which allows unauthenticated attackers to trigger remote code execution on the server. The flaw is triggered by sending a crafted HTTP or HTTPS request to the exposed Invoker Servlet on an affected NetWeaver AS Java system, with no credentials required. Successful exploitation gives an attacker the ability to run arbitrary code on the SAP application server, typically at the privileges of the application service, exposing business data and enabling further attacks into the environment. Any organization running SAP NetWeaver with the Java application server stack — particularly instances reachable from the internet or untrusted networks — is affected. Exploitation is confirmed in the wild: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2021-11-03 (ransomware use unknown), EPSS estimates a 17.4% probability of exploitation within 30 days (97th percentile), and no public proof-of-concept code is known. Do: Inventory all SAP NetWeaver AS Java instances and prioritize internet-exposed ones for remediation, applying SAP's updates per vendor instructions as required by the CISA KEV entry. Until patched, require authentication for or restrict access to the Invoker Servlet and limit HTTP/HTTPS access to the AS Java ports to trusted networks, then verify the fix is in place. | — | 17% | KEV |
| largetens of thousands of internet-exposed SAP NetWeaver AS Java systems (10k–100k order of magnitude) | |
| CVE-2016-3976 | Directory Traversal File-Read Flaw in SAP NetWeaver Application Server (Java) SAP NetWeaver Application Server (Java) contains a directory traversal vulnerability (CWE-22) in its CrashFileDownloadServlet. A remote attacker sends a request to the servlet with a dot-dot-backslash (..\) traversal sequence in the fileName parameter, causing the server to step outside the intended directory and return the contents of arbitrary files. Successful exploitation lets the attacker read sensitive files on the host, such as configuration or credential material, which can support further compromise; no code execution is involved. Any organization running SAP NetWeaver Application Server Java, typically large enterprises with SAP landscapes, is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, and EPSS assigns a 46.6% probability of exploitation in the next 30 days (99th percentile). Do: Apply SAP security updates for NetWeaver AS Java per vendor instructions, as required by CISA's KEV listing. Until patched, restrict network access to the CrashFileDownloadServlet endpoint from untrusted networks and review web logs for requests using dot-dot-backslash (..\) sequences in the fileName parameter. Prioritize internet-facing SAP Java instances, since exploitation is confirmed and the EPSS score indicates high near-term exploitation probability. | 7.5 | 47% | KEV PoC ×3 |
| largetens of thousands of SAP NetWeaver AS Java installations worldwide, with thousands plausibly internet-exposed (estimate) | |
| CVE-2016-9563 | Authenticated XXE in SAP NetWeaver Application Server Java (BPM component) CVE-2016-9563 is an XML External Entity (XXE) injection flaw (CWE-611) in SAP NetWeaver Application Server for Java, located in the BC-BMT-BPM-DSK (Business Process Management) component. A remote attacker holding valid authenticated credentials submits crafted XML containing external entity references, which the server's XML parser resolves. Successful exploitation allows the attacker to read local files from the server and potentially trigger server-side requests (SSRF), enabling disclosure of sensitive configuration or credential material that can support further compromise. Any organization running SAP NetWeaver AS Java with the BPM component is affected, with exposure determined by whether such systems are reachable and by the privileges an attacker can obtain. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming exploitation in the wild, though no public proof-of-concept is known and ransomware use is undetermined. Do: Apply the SAP security note/patch addressing CVE-2016-9563 to SAP NetWeaver AS Java per vendor instructions, as required by the CISA KEV listing. Verify whether your AS Java estate includes the BPM (BC-BMT-BPM-DSK) component and whether those instances are internet-reachable, and review authentication on affected services. As interim mitigation, restrict and monitor authenticated access to the affected component and watch logs for XML parser activity indicative of XXE (unexpected external entity resolution or outbound connections from the application server). | 6.5 | 24% | KEV |
| largeOrder of tens of thousands of SAP NetWeaver AS Java installations plausibly affected; exact exposed-instance count unknown | |
| CVE-2018-2380 | Path Traversal in SAP Customer Relationship Management (CRM) CVE-2018-2380 is a path traversal flaw (CWE-22) in SAP Customer Relationship Management (CRM) caused by insufficient validation of path information supplied by users. An attacker triggers it by submitting crafted path input to the vulnerable CRM functionality, allowing requests to reach files or directories outside the intended scope. Successful exploitation can enable unauthorized access to or manipulation of files on the SAP CRM server, potentially supporting further compromise; CISA notes known ransomware use. Any organization running SAP CRM is potentially affected, with risk concentrated in deployments where the application is reachable by untrusted users. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and EPSS assigns a high 28.9% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known. Do: Apply SAP's security updates per vendor instructions as required by CISA, and identify all SAP CRM instances in your environment, prioritizing any that are internet-facing. Because ransomware use is known, verify the integrity of affected SAP servers and restrict network access to them from untrusted networks. Check with SAP's advisory for the specific affected releases, since the provided data does not enumerate version ranges. | 6.6 | 29% | KEV ransomware PoC ×2 |
| large≈10,000–100,000 enterprise installations worldwide (order-of-magnitude estimate) | |
| CVE-2020-6207 | Unauthenticated RCE in SAP Solution Manager 7.2 (CWE-306) CVE-2020-6207 is a missing authentication check (CWE-306) in the User Experience Monitoring service of SAP Solution Manager 7.2, allowing an unauthenticated remote attacker to interact with the service over the network. The flaw is triggered simply by connecting to the unauthenticated service, and CVSS v3.1 scores it 9.8 Critical with network vector, low complexity, and no privileges or user interaction required. A successful attacker achieves remote command execution on the Solution Manager host and complete compromise of every SMDAgent connected to it, with public reporting noting the exploit yields root-level access. Any organization running SAP Solution Manager 7.2 — deployed across the majority of large SAP enterprise landscapes — is affected, particularly where the monitoring service is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2021-11-03), a fully functional public exploit exists, scanning activity against SAP systems has been reported, and EPSS assigns a 98.3% probability of exploitation within 30 days (100th percentile). Do: Apply SAP's patch for this vulnerability (SAP Security Note 2914509) per vendor instructions, as required by the CISA KEV catalog, and ensure all connected SMDAgents are updated with the Solution Manager. Until patched, restrict or block external access to the Solution Manager monitoring service from untrusted networks, since active scanning of SAP systems has been observed. Check whether your instance exposes the affected service to the internet and hunt for signs of compromise on the SolMan host and connected SMDAgents. | 9.8 | 98% | KEV PoC ×2 |
| moderate≈2,000–5,000 internet-exposed instances (out of tens of thousands of total SolMan deployments worldwide) | |
| CVE-2020-6287 | Missing Authentication (RECON) in SAP NetWeaver AS Java LM Configuration Wizard CVE-2020-6287 is a missing authentication check (CWE-306) in the LM Configuration Wizard component of SAP NetWeaver Application Server Java versions 7.30, 7.31, 7.40 and 7.50. An unauthenticated remote attacker can reach the configuration interface over the network and execute critical configuration tasks without any credentials. This allows the attacker to create administrative users and take full control of the SAP Java system, compromising its confidentiality, integrity and availability. Any organization running SAP NetWeaver AS Java on the affected versions is exposed, especially instances where the LM Configuration Wizard is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, carries a 94.7% EPSS probability of exploitation within 30 days, and news reports describe mission-critical SAP applications under active attack. Do: Apply SAP's security updates for NetWeaver AS Java 7.30, 7.31, 7.40 and 7.50 per the vendor's instructions (patches were released in July 2020), prioritizing internet-facing systems given the CISA KEV listing. As an interim mitigation, restrict network access to or disable the LM Configuration Wizard on affected systems. Also audit the system for unexpected or newly created administrative users and review access logs for unauthenticated configuration requests. | 10.0 | 95% | KEV |
| largetens of thousands of installations, with thousands directly internet-exposed |
Full article745 words · extracted from helpnetsecurity.com · click to collapse
Newly provisioned, unprotected SAP applications in cloud environments are getting discovered and compromised in mere hours, Onapsis researchers have found, and vulnerabilities affecting them are being weaponized in less than 72 hours after SAP releases security patches.
Internet-exposed systems are more likely to be exploited and compromised, but there are also threats out there that are equipped to compromise SAP systems from the inside, they noted. The attackers can then move to steal or modify data and disrupt critical business operations.
SAP applications critical to businesses
SAP applications power mission-critical operations at more than 400,000 organizations globally – organizations in essential industries such as food distribution, medical device manufacturing, pharmaceuticals, critical infrastructure, government and defense, and so on.
SAP applications support critical operations/processes such as enterprise resource planning, supply chain and product lifecycle management, human capital and customer relationship management, and others, and contain a treasure trove of sensitive (customer, employee, supplier and company) data.
If that data is accesses or changed by unauthorized persons, the companies risk not only losing that data, but also falling afoul of various data privacy, financial reporting and industry-specific regulation.
SAP applications compromised via known vulnerabilities
Since mid-2020, Onapsis researchers have recorded more than thousands of exploitation events and 300 successful exploit attempts on unprotected SAP instances. Some attacks were automated and some involved attackers sitting at their keyboards, but most aimed to exploit known issues and weaknesses.
These include six vulnerabilities (CVE-2020-6287, CVE-2020-6207, CVE-2018-2380, CVE-2016-9563, CVE-2016-3976, CVE-2010-5326) and a security weakness: unsecured configuration settings used by attackers to attempt to brute-force the passwords of high-privilege user accounts (SAP, SAPCPIC, TMSADM, CTB_ADMIN) that are usually installed on an SAP environment during deployment and configuration.
The vulnerabilities – some dating back to 2011 and some discovered only last lear – have all been patched by SAP, and the company provides instruction on how to change the default passwords of high-privilege user accounts, but according to Onapsis, there’s still a high number of organizations running SAP applications configured with high-privilege users with default and/or weak passwords.
The attackers’ tactics, techniques and procedures
The attackers:
- Perform reconnaissance by scanning for SAP-specific ports and SAP vulnerabilities (using scripts and tools derived from publicly available information)
- Achieve initial access by exploiting the aforementioned vulnerabilities on public-facing apps
- Achieve persistence by dropping web shells
- Concatenate several of the aforementioned vulnerabilities to escalate their privileges on the underlying OS
- Use vulnerabilities for creating high-privilege accounts at the application level or brute-forcing for discovering credentials that allow high-privilege access
- Explore the accessed applications
Once they successfully compromise a SAP application, threat actors have also been spotted applying documented mitigations to prevent further exploitation of the same vulnerabilities by other attackers.
Some vulnerabilities are used by attackers to move laterally and compromise additional systems additionally to the initially exploited system. Though, as the researchers noted, “with remote access to SAP systems and mission-critical applications, the need for lateral movement is nearly eliminated, enabling attackers to reach and exfiltrate business-critical data more quickly.”
Speedy compromise
Attackers are quick to probe and attempt to compromise newly provisioned cloud-based SAP applications: it sometimes takes them three hours, but on average, under one week.
They are also quick to create and use functional exploits for newly patched vulnerabilities, often times succeeding in less than 72 hours since the release of patches.
But, while most of the observed threat activity is related to the use of publicly-available exploits released following SAP patches, Onapsis researchers says that some threat actors are using custom/private exploits not available in the public domain.
The company says that their analysis proves how critical it is to quickly apply relevant SAP security patches and secure configurations (or compensating controls if those can’t be applied in a timely manner), check SAP applications for misconfigured and unauthorized high-privilege users, and implement a specific mission-critical application protection program.
Those organizations that know they have been lax in applying patches should use available IoCs and tools to check for compromise.
“If an attacker is able to gain access to an unprotected SAP system by exploiting a vulnerable internet-facing application or executing an attack from inside the organization on insecure systems, the business impact could be critical,” they added.
“In many scenarios, the attacker would be able to access the vulnerable SAP system with maximum privileges, bypassing all access and authorization controls. This means that the attacker could gain full control of the affected SAP system, its underlying business data and processes.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/04/07/sap-applications-compromised/