SAP security note 2896025, "[CVE-2020-6282] Server-Side Request Forgery in SAP NetWeaver AS JAVA (IIOP service)". Below are the symptom and SAP recommended solution.
Description
Symptom
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the IIOP service of SAP NetWeaver AS JAVA. This vulnerability allows attackers to send crafted requests from a vulnerable web application to target internal systems behind firewalls, which are typically inaccessible from external networks. Potential impacts include:
- Scanning internal networks to map infrastructure
- Gathering information for further exploits or attacks
- Performing Remote File Inclusion attacks
- Retrieving sensitive server files (e.g., /etc/passwd)
- Bypassing firewalls to execute malicious requests through the server
Solution
Implement a whitelist mechanism using the newly introduced multivalue properties allowed.client.hosts and allowed.orb.hosts in the SAP NetWeaver AS Java IIOP service.
- allowed.client.hosts: specify trusted client hosts (e.g., 12.34.56.78;host1;host2)
- allowed.orb.hosts: specify allowed orb hosts and their ports (e.g., 12.34.56.78:2345,3456,4567;host1:2345,3456;host2:4567)
Update SAP NetWeaver AS JAVA by applying the corrective measures outlined in the Validity and Support Packages and Patches sections of this SAP Note. If you have standalone IIOP clients, add their IPs or hostnames to the allowed.client.hosts property to authorize their connections.
CVSS
Score 5.8 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Full note on SAP: SAP Support Launchpad note 2896025
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
