SAP security note 2841053, “[CVE-2020-6186] Denial of Service (DOS) Vulnerability in SAP Host Agent”. Below are the symptom and SAP recommended solution.
Description
Symptom
An unauthenticated attacker can cause denial of service of the SAP Host Agent authentication service by sending malicious requests.
Solution
The recommended way to operate an SAP system is to only expose network services in untrusted networks that really need to be accessed by users in such networks. The SAP Host Agent usually only needs to be accessed in the datacenter. By restricting access to the ports 1128 and 1129 to the datacenter network, you can protect the SAP Host Agent against malicious attacks.
You can use SAP Host Agent’s IP-based access control features to expose these ports to trusted networks or trusted addresses only. For more information, see SAP Host Agent Security Configuration.
If you need to expose the SAP Host Agent to untrusted networks, as of SAP Host Agent version 7.21 PL45, you can disable username/password-based authentication and only allow certificate-based authentication. This can be done by setting the following parameter: saphostagent/authentication_method = disabled in the SAP Host Agent profile: Unix /usr/sap/hostctrl/exe/host_profile, Windows %ProgramFiles%\SAP\hostctrl\exe\host_profile.
To apply this setting, the SAP Host Agent must be restarted: Unix /usr/sap/hostctrl/exe/saphostexec -restart, Windows %ProgramFiles%\SAP\hostctrl\exe\saphostexec -restart.
Reason and prerequisites
SAP Host Agent’s username/password-based authentication is based on facilities provided by the operating system. A widely adopted protection method against brute force authentication attacks offered by these OS authentication facilities is to delay failed authentication attempts.
The OS-based authentication may be configured to delegate authentication requests to a remote server (e.g., LDAP, Active Directory, etc.). To protect these OS-based authentication and infrastructure components, the SAP Host Agent limits the number of parallel authentication requests.
If the OS-based authentication uses the above-described attack protection method, it may slow down the processing of other username/password-based authentication requests, which can lead to a delayed response.
CVSS
Score 7.5 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Full note on SAP: SAP Support Launchpad note 2841053
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].