Update 2 to Security Note 2808158 CVE-2019-0330 OS Command Injection vulnerability in SAP Diagnostics Agent, SAP security note 2839864

SAP security note 2839864, “Update 2 to Security Note 2808158: [CVE-2019-0330] OS Command Injection vulnerability in SAP Diagnostics Agent”. Below are the symptom and SAP recommended solution.

Description

Symptom

UPDATE 14th April 2020: This note has been re-released with an updated ‘Attachments’ section. The file "old_commands.xml" has been corrected.

This SAP security note replaces the corrections provided in security notes 2808158 and 2823733.

The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Some well-known impacts of Code Injection vulnerability are:

• Unauthorized execution of commands
• Sensitive information disclosure
• Denial of Service

Solution

For SPs 6-9:

• Apply the new LM_SERVICE patch. Refer to the referenced SAP Notes for your SP.

For lower SPs:

• Replace the commands.xml with the attached file new_commands.xml. The commands.xml will be cleared of almost all commands. As a result, commands for the OS Command Collector have to be added manually to the commands.xml. For reference, the old_commands.xml is attached to this SAP Note. When adding commands for this purpose, it is strongly recommended to use the param="false" setting to prohibit potential attackers from injecting commands into them.

Steps to replace the commands.xml:

• 1. Go to the Agent Administration
• 2. Open the Application Configuration Tab
• 3. Navigate to the com.sap.smd.agent.application.remoteos folder
• 4. Under Application Resources, select the commands.xml
• 5. Click on “Download Default Resource” to download the current commands.xml
• 6. In the Bottom Section, upload the new commands.xml, either for all Diagnostics Agents or one particular Diagnostics Agent, using the “Select an Agent” button or the dropdown next to it.

Reason and prerequisites

The security notes 2808158 and 2823733 do not address all identified attack scenarios.

CVSS

Score 9.1 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

• 2840009 – LM-SERVICE 7.20 SP 9 Patch 2
• 2840008 – LM-SERVICE 7.20 SP 8 Patch 11
• 2840006 – LM-SERVICE 7.20 SP 7 Patch 13
• 2840005 – LM-SERVICE 7.20 SP 6 Patch 11
• 2823733 – Update 1 to Security Note 2808158
• 2808158 – [CVE-2019-0330] OS Command Injection vulnerability in SAP Diagnostics Agent