AA20-195A: Critical Vulnerability in SAP NetWeaver AS Java

["US-CERT" <US-CERT () ncas us-cert gov>]

Cybersecurity and Infrastructure Security Agency Logo

National Cyber Awareness System:



AA20-195A: Critical Vulnerability in SAP NetWeaver AS Java [ https://us-cert.cisa.gov/ncas/alerts/aa20-195a ] 
07/13/2020 07:07 PM EDT 
Original release date: July 13, 2020

Summary

On July 13, 2020 EST, SAP released a security update to address a critical vulnerability, CVE-2020-6287 [ 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287 ], affecting the SAP NetWeaver Application Server (AS) 
Java component LM Configuration Wizard. An unauthenticated attacker can exploit this vulnerability through the 
Hypertext Transfer Protocol (HTTP) to take control of trusted SAP applications.

Due to the criticality of this vulnerability, the attack surface this vulnerability represents, and the importance of 
SAPs business applications, the Cybersecurity and Infrastructure Security Agency (CISA) strongly recommends 
organizations immediately apply patches. CISA recommends organizations prioritize patching internet-facing systems, and 
then internal systems.

Organizations that are unable to immediately patch should mitigate the vulnerability by disabling the LM Configuration 
Wizard service (see SAP Security Note #2939665 [ https://launchpad.support.sap.com/#/notes/2939665 ]). Should these 
options be unavailable or if the actions will take more than 24 hours to complete, CISA strongly recommends closely 
monitoring your SAP NetWeaver AS for anomalous activity.

CISA is unaware of any active exploitation of these vulnerabilities at the time of this report. However, because 
patches have been publicly released, the underlying vulnerabilities could be reverse-engineered to create exploits that 
target unpatched systems.


Technical Details

Affected Systems

This vulnerability is present by default in SAP applications running on top of SAP NetWeaver AS Java 7.3 and any newer 
versions (up to SAP NetWeaver 7.5). Potentially vulnerable SAP business solutions include any SAP Java-based solutions 
such as (but not limited to):


  * SAP Enterprise Resource Planning, 
  * SAP Product Lifecycle Management, 
  * SAP Customer Relationship Management, 
  * SAP Supply Chain Management, 
  * SAP Supplier Relationship Management, 
  * SAP NetWeaver Business Warehouse, 
  * SAP Business Intelligence, 
  * SAP NetWeaver Mobile Infrastructure, 
  * SAP Enterprise Portal, 
  * SAP Process Orchestration/Process Integration), 
  * SAP Solution Manager, 
  * SAP NetWeaver Development Infrastructure, 
  * SAP Central Process Scheduling, 
  * SAP NetWeaver Composition Environment, and 
  * SAP Landscape Manager. 

Attack Surface

The vulnerability was identified in a component that is part of the SAP NetWeaver AS Java. This technology stack is 
part of the SAP Solution Manager, which is a support and system management suite.

The SAP NetWeaver AS for Java technology supports the SAP Portal component, which may therefore be affected by this 
vulnerability and is typically exposed to the internet. Passive analysis of internet-facing applications indicates that 
a number of such applications are connected to the internet and could be affected by this vulnerability.

Description

On July 13, 2020 EST, SAP released the patch for a critical vulnerability, CVE-2020-6287, affecting its NetWeaver AS 
for Java component. This vulnerability can lead to compromise of vulnerable SAP installations, including the 
modification or extraction of highly sensitive information, as well as the disruption of critical business processes. A 
remote, unauthenticated attacker can exploit this vulnerability through an HTTP interface, which is typically exposed 
to end users and, in many cases, exposed to the internet.

The vulnerability is introduced due to the lack of authentication in a web component of the SAP NetWeaver AS for Java 
allowing for several high-privileged activities on the SAP system.

Impact

If successfully exploited, a remote, unauthenticated attacker can obtain unrestricted access to SAP systems through the 
creation of high-privileged users and the execution of arbitrary operating system commands with the privileges of the 
SAP service user account (<sid>adm), which has unrestricted access to the SAP database and is able to perform 
application maintenance activities, such as shutting down federated SAP applications. The confidentiality, integrity, 
and availability of the data and processes hosted by the SAP application are at risk by this vulnerability.


Mitigations

CISA strongly recommends organizations review SAP Security Note #2934135 [ 
https://launchpad.support.sap.com/#/notes/2934135 ] for more information and apply critical patches as soon as 
possible. CISA recommends prioritizing patching over application of individual mitigations. When patching, external 
facing systems should be urgently addressed, followed by internal systems.

Patched versions of the affected components are available at the SAP One Support Launchpad [ 
https://launchpad.support.sap.com/ ].

Additional Recommendations

CISA encourages users and administrators of SAP products to:


  * Scan SAP systems for all known vulnerabilities, such as missing security patches, dangerous system configurations, 
and vulnerabilities in SAP custom code. 
  * Apply missing security patches immediately and institutionalize security patching as part of a periodic process 
  * Ensure secure configuration of your SAP landscape 
  * Identify and analyze the security settings of SAP interfaces between systems and applications to understand risks 
posed by these trust relationships. 
  * Analyze systems for malicious or excessive user authorizations. 
  * Monitor systems for indicators of compromise resulting from the exploitation of vulnerabilities. 
  * Monitor systems for suspicious user behavior, including both privileged and non-privileged users. 
  * Apply threat intelligence on new vulnerabilities to improve the security posture against advanced targeted attacks. 
  * Define comprehensive security baselines for systems and continuously monitor for compliance violations and 
remediate detected deviations. 

These recommendations apply to SAP systems in public, private, and hybrid cloud environments.

See the Onapsis report on theRECON SAP Vulnerability [ https://www.onapsis.com/recon-sap-cyber-security-vulnerability ] 
for more information.

ACKNOWLEDGEMENTS

SAP and Onapsis contributed to this Alert.

RESOURCES

[1] Onapsis Threat Report https://www.onapsis.com/recon-sap-cyber-security-vulnerability
[2] CVE-2020-6287 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287%20 [ 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287 ]
[3] SAP Security Note 2934135 patching the issue (https://launchpad.support.sap.com/#/notes/2934135)
[4] SAP Trust Center (www.sap.com/security [ http://www.sap.com/security ])
[5] SAP Monthly Security Patch Day Blog 
(https://wiki.scn.sap.com/wiki/display/PSR/The+Official+SAP+Product+Security+Response+Space)

References

  * [1] Onapsis Threat Report  [ https://www.onapsis.com/recon-sap-cyber-security-vulnerability ] 
  * [2] CVE-2020-6287 [ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6287 ] 
  * [3] SAP Security Note [ https://launchpad.support.sap.com/#/notes/2934135 ] 
  * [4] SAP Trust Center [ http://www.sap.com/security ] 
  * [5] SAP Monthly Security Patch Day Blog [ 
https://wiki.scn.sap.com/wiki/display/PSR/The+Official+SAP+Product+Security+Response+Space ] 

Revisions

  * July, 13 2020: Initial Version 
________________________________________________________________________

This product is provided subject to this Notification [ https://us-cert.cisa.gov/privacy/notification ] and this 
Privacy & Use [ https://www.dhs.gov/privacy-policy ] policy.

body { font-size: 1em; font-family: Arial, Verdana, sans-serif; font-weight: normal; font-style: normal; color: 
#333333; } ________________________________________________________________________

A copy of this publication is available at www.us-cert.gov [ https://www.us-cert.gov ]. If you need help or have 
questions, please send an email to info () us-cert gov. Do not reply to this message since this email was sent from a 
notification-only address that is not monitored. To ensure you receive future US-CERT products, please add US-CERT () 
ncas us-cert gov to your address book. 

OTHER RESOURCES: Contact Us [ http://www.us-cert.gov/contact-us/ ] | Security Publications [ 
http://www.us-cert.gov/security-publications ] | Alerts and Tips [ http://www.us-cert.gov/ncas ] | Related Resources [ 
http://www.us-cert.gov/related-resources ]  

STAY CONNECTED: Sign up for email updates [ http://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/new ]