CVE-2020-6287 Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard), SAP security note 2934135

SAP security note 2934135, “[CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)”. Below are the symptom and SAP recommended solution.

Description

Symptom

UPDATE 28th July 2020: This note has been re-released with updated Solution information. We changed the note text in the workaround statement mentioned. There have not been any changes done which require customer action.

This SAP security note addresses vulnerabilities identified in LM Configuration Wizard of SAP NetWeaver AS JAVA. The vulnerability details along with their CVE relevant information can be found below.

1. Missing Authentication (CVE-2020-6287): LM Configuration Wizard of SAP NetWeaver AS JAVA does not perform an authentication check, which allows an attacker without prior authentication to execute configuration tasks and perform critical actions against the SAP Java system. This includes the ability to create an administrative user, thereby compromising the Confidentiality, Integrity, and Availability of the system. CVSS Score: 10.0, Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

2. Path Traversal (CVE-2020-6286): Insufficient input path validation of certain parameters in the web service allows an unauthenticated attacker to exploit a method to download zip files to a specific directory. CVSS Score: 5.3, Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Solution

Authentication and authorization are enforced through code correction.

We recommend applying the patch immediately.

If you cannot apply the patch, then at least disable the application aliases as described in Note 2939665. Note 2939665 is a workaround and a defense in depth measure, but it is not a complete solution.

We recommend disabling the application aliases unless they are needed. These application aliases are required for a few SAP Lifecycle procedures only, such as the initial technical setup. They are not needed for day-to-day operations. You can temporarily re-enable these application aliases for executing SAP lifecycle procedures.

Reason and prerequisites

Authentication is missing in LM Configuration Wizard.

References

• Disable/Enable LM Configuration Wizard | Critical API’s in LM Configuration Wizard (Note 2939665)
• Check implementation of Note 2934135 based on data from SLD (Note 2953257)
• RECON – SAP Vulnerability (Note 2947895)
• FAQ for SAP Note 2934135 (Note 2948106)
• Central note for SAP NetWeaver 7.31 SP28 Application Server Java (Note 2968085)
• SAP Landscape Management – Collective Security Note (Note 2910170)
• CTC Framework not started (tc~lm~ctc~cul~startup_app) (Note 2951583)

CVSS

Score 10.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H