Latest SAP Security Vulnerabilities – Including an SAP CVSS 10

In this post, I’ll cover some of the latest vulnerabilities reported to SAP by Onapsis and published last week.

Last week we released advisories regarding several vulnerabilities affecting SAP platforms. Some of these vulnerabilities are in fact very critical, and their exploitation could lead to a full-compromise of the entire SAP implementation – even by completely anonymous attackers. Following our responsible disclosure policy, SAP released the relevant SAP Security Notes (patches) for all these vulnerabilities a long time ago, so if you are an SAP customer make sure you have properly implemented them!

These are the advisories for the published vulnerabilities, along with a small description of the real business impact of an exploitation of the vulnerabilities:

By exploiting this vulnerability, a remote unauthenticated attacker might be able to access or modify all the business information processed by the ERP system. This would result in the total compromise of the SAP infrastructure.

By exploiting this vulnerability, a remote unauthenticated attacker might be able to access or modify all the business information processed by the ERP system. This would result in the total compromise of the SAP infrastructure.

By exploiting this vulnerability, a remote unauthenticated attacker might be able to access or modify all the business information processed by the ERP system. This would result in the total compromise of the SAP infrastructure.

By exploiting this vulnerability, an internal or external attacker would be able to perform attacks on the Organization’s users through weaknesses in the SAP system. Upon a successful exploitation, he would be able to obtain sensitive information from legitimate users through complex social engineering attacks and/or exploit vulnerabilities in their systems in order to take control of them.

By exploiting this vulnerability, an attacker would be able to perform a sabotage attack over the service used to deploy and change software components in the SAP AS Java. This would prevent legitimate developers and administrators from performing and maintain required business and technical activities.

By exploiting this vulnerability, an internal or external attacker would be able to perform attacks on the Organization’s users through weaknesses in the SAP system. Upon a successful exploitation, he would be able to obtain sensitive information from legitimate users through the exploitation of vulnerabilities in their systems.

We think it is a very important set of vulnerabilities, as one of them is the first vulnerability ever ranked by SAP with a CVSSv2 risk 10! Actually, Onapsis also reported the second vulnerability ranked with a CVSSv2 10, and this advisory will be released next month.

We are going to be demonstrating some of these vulnerabilities live in our upcoming posts and presentations.

Share Button