CVE-2020-6207 Missing Authentication Check in SAP Solution Manager, SAP security note 2890213

SAP security note 2890213, "[CVE-2020-6207] Missing Authentication Check in SAP Solution Manager", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Update 9th March 2021: This note has been re-released with updated ‘Symptom’ information. Customers need to be on SAP Solution Manager 7.2 Support Package Stack 4 to 11 to implement the required patch. Lower Support Package Stacks are not supported. Support Package Stack 12 and higher contain the correction, no action is required.

Update 10th November 2020: This note has been re-released with updated ‘Support Packages & Patches’ information. For the release SOLMANDIAG 720, we added SP011 and the Patch level 000004.

Update 25th August 2020: This note has been re-released with updated ‘Symptom’ and ‘Solution’ information. Minor textual changes were made; no customer action required.

SAP Solution Manager User-Experience Monitoring does not perform any authentication for a service, resulting in the complete compromise of all SMDAgents connected to the Solution Manager.

Solution

This fix enables user authentication on the User-Experience Monitoring administration service and removes the root cause of CVE-2020-6207.

Prerequisites:

• Single Sign-On Configuration: Ensure that the Single Sign-On Automatic Activity in SAP Solution Manager Configuration has been executed successfully. This is available in transaction SOLMAN_SETUP under Cross Scenario Configuration > Mandatory Configuration > Infrastructure Preparation: Setup Connectivity > Enable Connectivity. Applies to all SAP Solution Manager 7.2 support packages.
• Enable Maintenance Mode: Use the Agent Administration UI to enable Maintenance Mode. Refer to the Release Information Note relevant to your SAP Solution Manager 7.2 Support Package stack, as listed in SAP Note 1595736.

Deployment Steps:

• Deploy the LM-SERVICE Software Component mentioned in the “Support Packages & Patches” section.

Interim Solution: EemAdmin Authentication

Note: This is an interim, temporary quick fix. The complete code-based solution should be implemented as described above.

• Log on to SAP NetWeaver Administration on the SAP Solution Manager Java Stack with the SAP J2EE Admin user.
• Navigate to Configuration > Infrastructure > Connectivity > Single Service Administration > Service Definitions.
• Search for the WSDL port Type named EemAdmin and press ‘Go’.
• Select it and display its configuration details in the ‘Details’ tab.
• In the ‘Security’ tab of the EemAdminBeanPort, enable the following options in the HTTP Authentication section: User ID/Password (enabled), X.509 Client Certificate (not enabled), Logon Ticket (enabled).
• Save the settings. No restart is required.

CVSS

Score 10.0 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References