CVE-2019-0389 Privilege escalation in SAP NetWeaver Application Server Java, SAP security note 2814357

SAP security note 2814357, "[CVE-2019-0389] Privilege escalation in SAP NetWeaver Application Server Java". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An administrator can alter privileges for Java Server functions, allowing users to execute unauthorized functions. Specifically, Enterprise Java Beans (EJBs) called via the deprecated JCo RFC Provider service may run with elevated permissions if an administrator manually starts or restarts a JCo RFC Provider Destination.

Solution

1. Download and Deploy Patches: Depending on your SAP NetWeaver release, download and deploy the necessary patches from the "Support Package Patches" section of this SAP Note 2814357.
2. Restart AS Java: After applying the patches, restart the NetWeaver AS Java instance to ensure the patches take effect.
3. Default Execution Context: Post-patch, EJBs called via JCo RFC Provider will run in an anonymous thread context with guest user permissions unless an explicit user logon is performed.

Reason and prerequisites

The vulnerability arises when an administrator starts or restarts JCo RFC Provider Destinations via the NetWeaver Administration UI (NWA). EJBs called through these destinations execute with the administrator’s permissions. This issue does not affect destinations started automatically at AS Java startup or those that perform explicit user logons.

CVSS

Score 5.9 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

References

Affected components

• J2EE ENGINE FRAMEWORK 7.10 to 7.50