Fully-functional exploit code is now publicly available for a maximum severity pre-auth vulnerability impacting default configurations of an SAP Solution Manager (SolMan) component.
SAP SolMan is an application lifecycle manager deployed in almost all SAP environments and designed to help unify the management of all SAP and non-SAP systems within a single interface.
SolMan is also used as an administrative utility for monitoring and maintaining mission-critical SAP enterprise applications including but not limited to an organization’s ERP, BI, CRM, SCM, and financials.
Skills level required for exploitation drastically lowered
This critical security flaw is tracked as CVE-2020-6207 and it is caused by a missing authentication check in the EEM Manager Solman component that could lead to the takeover of connected SAP systems.
It can be remotely exploited in low complexity attacks by unauthenticated attackers with access to the SolMan HTTP(s) port, with no user interaction required, which explains its 10/10 CVSS3 severity rating given by SAP.
Although the vulnerability was disclosed and patched by SAP in March 2020, this is the first time that public exploit code was released which drastically lowers the skill level needed by attackers to exploit servers unpatched against CVE-2020-6207.
“While exploits are released regularly online, this hasn’t been the case for SAP vulnerabilities, for which publicly available exploits have been limited,” Onapsis Research Labs, who first spotted the public exploit after being published by a security researcher on GitHub, said in a report published earlier this week.
“The release of a public exploit significantly increases the chance of an attack attempt since it also expands potential attackers not only to SAP-experts or professionals but also to script-kiddies or less-experienced attackers that can now leverage public tools instead of creating their own.”
Impact of a successful attack
Attacks successfully abusing this vulnerability would expose virtually all of an organization’s SAP applications, business process, and data to exfiltration or tampering, and will compromise all systems managed using the compromised SolMan instance.
To make matters worse, SolMan is regularly disregarded when implementing patching policies and it’s commonly governed by separate, often out-of-date policies.
“A successful exploitation could allow a remote unauthenticated attacker to execute highly privileged administrative tasks in the connected SAP SMD Agents (satellite systems connected to SolMan can be affected as well),” Onapsis added.
“It is not possible to list everything that can potentially be done in the systems if exploited, since having admin privileged control in the systems or running OS commands basically make it limitless for an attacker.”
Onapsis did however highlighted the following feasible malicious tasks attackers could execute after compromising a SolMan server:
- Shutting down any SAP system in the landscape (not only SAP SolMan)
- Causing IT control deficiencies impacting financial integrity and privacy leading to regulatory compliance violations such as Sarbanes-Oxley (SOX), GDPR and others
- Deleting any data in the SAP systems, including key data that can cause business disruption
- Assigning superuser (e.g. SAP_ALL) privileges to any existing or new user, enabling those users to run business operations that would normally require specific privileges to bypass other Segregation of Duties (SoD) controls
- Reading sensitive data from the database, including employee and customer personal information
To fully mitigate attacks attempting to exploit CVE-2020-6207 on their SAP systems, organizations have to apply the security update released by SAP in March 2020.
The security researcher who published the CVE-2020-6207 exploit code on GitHub also released a proof-of-concept exploit for another maximum severity remote code execution vulnerability in the SAP NetWeaver AS JAVA component, discovered and named RECON by Onapsis.
Onapsis also discovered and disclosed info on publicly available critical exploits targeting misconfigured SAP installations, collectively dubbed 10KBLAZE.
These exploits exposed roughly 90% out of an estimated total of 1,000,000 SAP production systems to the potential risk of being hacked if misconfigured.
