CVE-2020-26837 Multiple Vulnerabilities in SAP Solution Manager 7.2 (User Experience Monitoring), SAP security note 2983204

SAP security note 2983204, “[CVE-2020-26837] Multiple Vulnerabilities in SAP Solution Manager 7.2 (User Experience Monitoring)”. Below are the symptom and the SAP recommended solution.

Description

Symptom

This SAP security note addresses multiple vulnerabilities identified in SAP Solution Manager 7.2 (User Experience Monitoring). The vulnerability details along with their CVE relevant information can be found below.

Path Traversal: An authenticated non-administrative user of SAP Solution Manager 7.2 (User Experience Monitoring) can deploy a malicious script which can exploit an existing path traversal vulnerability to fully compromise confidentiality by exposing elements of the file system and partially compromise availability by making certain services unavailable (CVE-2020-26837).

Missing Authorization Check: SAP Solution Manager 7.2 (User Experience Monitoring) does not perform necessary authorization checks for an authenticated user. Due to inadequate access control, a network attacker authenticated as a regular user can use operations which should be restricted to administrators. These operations can be used to deploy a malicious User Experience Monitoring script (CVE-2020-26830).

These issues are relevant for all customers using SAP Solution Manager 7.2 with LM-SERVICE 7.20 deployment.

Solution

This fix enforces user authorization checks on the User-Experience Monitoring administration service and thereby removes the root cause of CVE-2020-26830.

Before proceeding:

• Ensure Single Sign-On Automatic Activity in SAP Solution Manager Configuration has been executed successfully. This is available in transaction SOLMAN_SETUP under Cross Scenario Configuration > Mandatory Configuration > Infrastructure Preparation: Setup Connectivity > Enable Connectivity. Applicable for all SAP Solution Manager 7.2 support packages.
• Enable Maintenance Mode using the Agent Administration UI. This procedure is described in the Release Information Note relevant to your SAP Solution Manager 7.2 Support Package stack, as listed in SAP Note 1595736.
• If the workaround was previously applied, revert it before continuing.

Patching procedure for SP03-SP11: deploy the LM-SERVICE 7.20 software component as mentioned in the Support Packages & Patches section for SP03-SP11.

Additional procedure for SP03:

• Log in to SAP NetWeaver Administration on the SAP Solution Manager Java Stack with the SAP J2EE Admin user.
• Navigate to Configuration > Connectivity > Single Service Administration > Service Definitions.
• Search for WSDL port type named ‘EemAdmin’ and click ‘Go’.
• Select it and display its configuration details in the ‘Details’ tab.
• Under the ‘Security’ tab of the EemAdminBeanPort, enable User ID/Password and Logon Ticket in the Http Authentication section.
• Save the settings. No restart is required.

CVSS

CVE-2020-26837 (Path Traversal) – Score 8.5 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

CVE-2020-26830 (Missing Authorization Check) – Score 7.6 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

• Missing Authorization check and Path traversal in SAP Solution Manager 7.2: FAQ
• LM-SERVICE 7.20 SP 7 Patch 26
• LM-SERVICE 7.20 SP 6 Patch 19
• LM-SERVICE 7.20 SP 3 Patch 8
• LM-SERVICE 7.20 SP 5 Patch 19
• LM-SERVICE 7.20 SP 4 Patch 17
• LM-SERVICE 7.20 SP 11 Patch 5
• LM-SERVICE 7.20 SP 10 Patch 9
• LM-SERVICE 7.20 SP 9 Patch 18
• LM-SERVICE 7.20 SP 8 Patch 24