SAP security note 2747683, "[CVE-2019-0283] SAP NetWeaver Process Integration (Adapter Engine) vulnerable to Digital Signature Spoofing", is a program error note released on 09.04.2019. Below are the symptom and the SAP recommended solution.
Description
Symptom
It is possible to spoof XML signatures and send arbitrary requests to the server via the PI Axis adapter. These requests will be accepted by the PI Axis adapter even if the payload has been altered, especially when the signed element is the body of the XML document.
Some well-known impacts of the Digital Signature Spoofing vulnerability are:
- Arbitrary requests can be sent and accepted by the server, completely bypassing the signature security mechanism in place.
- An attacker can modify critical information.
- In some cases, an attacker can obtain information from the spoofing signer.
Solution
The issue has been fixed by code correction in the PI Axis Adapter. All signed elements are now checked additionally for their correctness before signature validation.
- Deploy the fixed Support Packages and Patches referenced by this SAP Note.
- If you are using a very old version of PI with no code correction available, ensure all incoming requests to the PI Axis Adapter use a secure transport protocol (SSL) to minimize the risk.
Reason and prerequisites
The attacker needs a valid request with a valid signature to use this attack (man-in-the-middle).
CVSS
Score 7.1 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
References
This note refers to
Full note on SAP: SAP Support Launchpad note 2747683
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
