SAP security note 2813811, "[CVE-2019-0345] Server-Side Request Forgery in SAP NetWeaver Application Server for Java (Administrator System Overview)", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
AS Java System Overview in SAP NetWeaver Administrator (NWA) allows an attacker to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability.
Some well-known impacts of SSRF vulnerability are:
- Scan internal network to determine internal infrastructure
- Information gathering for further exploits/attacks
- Perform a Remote File Inclusion attack
- Retrieve server files (including /etc/passwd and more)
- Bypass Firewall and force the vulnerable server to perform malicious requests
Solution
The vulnerable web service is removed from the project.
Kindly apply the patch from the Support Packages & Patches section.
After applying the fix, some systems’ System Overview may display incorrect information about started/failed Java server nodes, for example, these monitors may show N/A values. This side effect is resolved by applying the settings from SAP KBA 2577844.
Reason and prerequisites
An attacker can trick the AS Java System Overview in NWA to gather information for further exploits/attacks.
CVSS
Score 9.0 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
This note refers to
Affected components
- LM-CORE 7.30
- LM-CORE 7.31
- LM-CORE 7.40
- LM-CORE 7.50
Full note on SAP: SAP Support Launchpad note 2813811
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].