Unraveling the Web: Deep Dive into Critical SAP Vulnerabilities and their Wormable Exploit Chain

Vulnerabilities Details Disclosed for Critical SAP Vulnerabilities, Including Wormable Exploit Chain

Background

A cybersecurity firm has recently disclosed critical vulnerabilities in SAP software that could expose organizations to attacks. The vulnerabilities were discovered by researcher Fabian Hagg from SEC Consult, an Austria-based cybersecurity consulting firm. Hagg found these flaws as part of a three-year research project, and SAP has since released patches to address the vulnerabilities.

Impacted Systems

The vulnerabilities, which include both design and implementation problems, are specifically found in the Remote Function Call (RFC) interface of SAP systems. This interface is used for communication between SAP systems, and the vulnerabilities affect several SAP products, including SAP ERP Central Component (ECC), S/4HANA, BW/4HANA, Solution Manager (SolMan), and more. While these systems are typically only reachable internally, there may be certain products and configurations that could allow exploitation of the vulnerabilities directly from the internet.

Risk and Impact

Two of the vulnerabilities have been assigned a “critical” severity rating based on their CVSS score. Exploitation of these vulnerabilities can result in a full system compromise. The attacker only needs network access to the targeted system, and no user interaction or special permissions are required to exploit the flaws. Additionally, if these vulnerabilities are chained together, they enable automated and wormable attacks, allowing for lateral movement within SAP environments.

Recommendations and Solutions

Although SAP has released patches to address these vulnerabilities, organizations must ensure that they have installed these fixes. SEC Consult recommends prioritizing systems that are exposed to untrusted networks for immediate patching. If patching is not an option, organizations should limit network-wise access to vulnerable servers as much as possible to minimize the attack surface. It is also crucial to enforce encrypted server-to-server communications using HTTPS and SNC protocols. The vendor has provided additional measures and guidance in the corresponding SAP notes and FAQ for Security Note 3089413.

Conclusion

The disclosure of critical vulnerabilities in SAP software, including the availability of a wormable exploit chain, underscores the importance of prompt patching and proactive security measures. Organizations must prioritize the installation of patches and implement proper network access controls to minimize the risk of exploitation. With the increasing sophistication of cyber threats, it is imperative for organizations to remain vigilant and stay updated with the latest security vulnerabilities and patches.