Full Disclosure mailing list archives
SEC Consult Vulnerability Lab Whitepaper: Everyone Knows SAP®, Everyone Uses SAP, Everyone Uses RFC, No One Knows RFC: From RFC to RCE 16 Years Later
From: "SEC Consult Vulnerability Lab, Research via Fulldisclosure" <fulldisclosure () seclists org>
Date: Thu, 29 Jun 2023 14:12:29 +0000
SEC Consult Vulnerability Lab Whitepaper < 20230629-0 > ======================================================================= Title: Everyone Knows SAP®, Everyone Uses SAP, Everyone Uses RFC, No One Knows RFC: From RFC to RCE 16 Years Later Researcher: Fabian Hagg (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= In an independent analysis on the server-side implementation of the proprietary Remote Function Call (RFC) interface in SAP NetWeaver Application Server ABAP and ABAP Platform (both hereinafter referred to as AS ABAP), a set of high-impact implementation bugs and design flaws were identified by SEC Consult Vulnerability Lab security researcher and SAP security expert Fabian Hagg. Technical details about the research results are presented during the annual Troopers Security Conference 2023 in Heidelberg, Germany. Remote Function Call (RFC) is a proprietary communication protocol required for all systems operating the SAP® Application Server for ABAP®, making it one of the most appealing targets for attacks on business-critical SAP system landscapes. With the talk ”Attacking the Giants: Exploiting SAP Internals” presented by M. Nunez at Black Hat Europe 2007, the protocol reached the security research community for the first time. Nowadays, SAP systems became increasingly interconnected not only internally, but also across network trust boundaries. This circumstance results in enterprises relying on the RFC interface technology and its codebase more than ever. The present paper reports on an independent analysis of the protocol as it is used in SAP NetWeaver® Application Server ABAP and ABAP Platform for server-to-server communication of type ’3’. By employing a hybrid security testing approach combining static and dynamic analysis techniques, the objective of this research in re-assessing the RFC attack surface yielded alternate logon material, cryptographic failures, memory corruptions, and ABAP programming pitfalls. This paper examines each of the identified vulnerabilities, demystifying somewhat forgotten inner workings of the protocol and key security mechanisms to highlight novel attack vectors and a wormable exploitation chain. Technical whitepaper: https://r.sec-consult.com/saprfcwhite Short blog post summary: https://r.sec-consult.com/saprfcblog TROOPERS23 conference page: https://troopers.de/troopers23/talks/n7yuqg/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Current thread:
- SEC Consult Vulnerability Lab Whitepaper: Everyone Knows SAP®, Everyone Uses SAP, Everyone Uses RFC, No One Knows RFC: From RFC to RCE 16 Years Later SEC Consult Vulnerability Lab, Research via Fulldisclosure (Jul 07)