SAP Solution Manager 7.2 - Remote Command Execution

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

98.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SAP Solution Manager (SolMan) running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem). The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents, send HTTP request (SSRF), and execute OS commands on connected SMDAgent.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system.

Fix

Apply the latest security patches provided by SAP to mitigate this vulnerability.

How to confirm it

Send: POST /EemAdminService/EemAdmin
Positive when: contains ":Envelope" and ":Body" and ":getAllAgentInfoResponse" AND contains in header "text/xml" and "SAP NetWeaver Application Server" AND status 200

Run it with nuclei: nuclei -id CVE-2020-6207 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-6207

info:
  name: SAP Solution Manager 7.2 - Remote Command Execution
  author: _generic_human_
  severity: critical
  description: SAP Solution Manager (SolMan) running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem). The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents, send HTTP request (SSRF), and execute OS commands on connected SMDAgent.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system.
  remediation: |
    Apply the latest security patches provided by SAP to mitigate this vulnerability.
  reference:
    - https://launchpad.support.sap.com/#/notes/2890213
    - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305
    - https://i.blackhat.com/USA-20/Wednesday/us-20-Artuso-An-Unauthenticated-Journey-To-Root-Pwning-Your-Companys-Enterprise-Software-Servers-wp.pdf
    - https://github.com/chipik/SAP_EEM_CVE-2020-6207
    - https://www.rapid7.com/db/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce/
    - https://www.rapid7.com/db/modules/exploit/multi/sap/cve_2020_6207_solman_rs/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-6207
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-6207
    cwe-id: CWE-306
    epss-score: 0.98135
    epss-percentile: 0.99912
    cpe: cpe:2.3:a:sap:solution_manager:7.20:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sap
    product: solution_manager
  tags: cve2020,cve,sap,solman,rce,kev,vkev,vuln

http:
  - raw:
      - |
        POST /EemAdminService/EemAdmin HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: ""
        Content-Type: text/xml; charset=UTF-8
        Connection: close

        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:adm="http://sap.com/smd/eem/admin/"><soapenv:Header/><soapenv:Body><adm:getAllAgentInfo/></soapenv:Body></soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ":Envelope"
          - ":Body"
          - ":getAllAgentInfoResponse"
        condition: and

      - type: word
        part: header
        words:
          - "text/xml"
          - "SAP NetWeaver Application Server"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from