SAP security note 2974774, "[CVE-2020-26829] Missing Authentication Check In SAP NetWeaver AS JAVA (P2P Cluster Communication)". Below are the symptom and SAP recommended solution.
Description
Symptom
P2P Cluster Communication is dedicated for the server nodes in the cluster to exchange messages between each other. However, due to an implementation flaw, it accepts arbitrary connections even from processes that are outside the cluster and even outside the network segment dedicated for the internal cluster communication. As a result, an unauthenticated attacker can invoke certain functions that would otherwise be restricted to system administrators only, including access to system administration functions or shutting down the system completely.
Solution
The Server Socket for P2P communication now listens only on the network interface dedicated to internal cluster communication. Extra security measures have been introduced in the P2P handshake protocol so that if attackers gain access to the network segment dedicated to the AS Java Cluster, they cannot establish a connection to the P2P Server Socket of any server nodes in the Cluster.
Apply the correction to your SAP NetWeaver AS Java system, according to the "Validity" and "Support Packages & Patches" sections of this note.
If you are prevented from applying this correction on your system, then apply the following workarounds:
- Configure Message Server ACL to allow P2P connections only from trusted IP addresses according to this documentation: Security Settings for the SAP Message Server.
- Make sure that the Join Port, opened by the P2P Server Socket, is protected on the network level via network segmentation, with firewall, or both. Furthermore, the communication between the cluster elements has to be secured via the IPsec protocol suite.
For frequently asked questions and answers related to this correction, see the associated KBA 2997167.
Reason and prerequisites
The Server Socket, used for accepting P2P connections from the other server nodes in the cluster, was opened to listen on all available network interface controllers.
CVSS
Score 10.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Full note on SAP: SAP Support Launchpad note 2974774
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].