CVE-2020-6191 Missing Input Validation in SAP Landscape Management, SAP security note 2878030

SAP security note 2878030, “[CVE-2020-6191] Missing Input Validation in SAP Landscape Management”. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker with admin privileges could run malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to missing input validation.

Solution

Prerequisites to ensure the fixes can be activated:

• Enable Validator: Ensure validator ‘SAP Landscape Management Internal Operation Check’ is enabled.
• Enable Validation: Ensure validation ‘LVMIntOpOld’ is enabled and not suppressed on any host.

Steps to Resolve:

• Install Patches: Install SAP Landscape Management 3.0 SP13 Patch 3 (Note 2887591). Install the SAP Adaptive Extensions Patch 52 (Note 1808793) on all managed hosts where SAP Adaptive Extensions have been installed before (e.g., SAP HANA hosts, appliance provisioning).
• Execute Mass Validation: Execute a mass validation on all hosts of your landscape for the validator ‘RuntimeInternalOperationValidator’ to activate the fixes immediately. If not executed manually, fixes will be enabled with the next automatic execution of the validation (24h by default).

Mounted operations.d Directory: If the operations.d directory of your managed hosts is mounted, update *.conf files from SAP Adaptive Extensions patch 52 as per SAP Note 1550099.

Note on the Installation Order: Ensure you install SAP Landscape Management 3.0 SP13 Patch 3 before installing SAP Adaptive Extensions Patch 52.

Reason and prerequisites

The attacker needs to authenticate as a user registered in the admin_group against the SAP Host Agent (via SOAP/remotely). The attacker needs to place a malicious executable on the filesystem of the target host. SAP Landscape Management needs to be installed with at least one managed host being configured.

Note: Typical users in admin_group are the sapadm user and Diagnostics Agent user.

CVSS

Score 7.2 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

• SAP Landscape Management 3.0 SP13 Patch03 (Note 2887591)
• SAP Adaptive Extension: Fixes for Patch 01 to Patch 55 (Note 1808793)
• Additional Host Agent Operations (Note 1550099)