CVE-2020-6263 Authentication Bypass in Standalone Clients connecting to SAP NetWeaver AS Java via P4 Protocol, SAP security note 2878568

SAP security note 2878568, "[CVE-2020-6263] Authentication Bypass in Standalone Clients connecting to SAP NetWeaver AS Java via P4 Protocol". Below are the symptom and SAP recommended solution.

Description

Symptom

Standalone clients connecting via NetWeaver AS Java P4 Protocol do not perform any authentication checks for operations that require user identity. An unauthenticated attacker could obtain limited information about the deployment and potentially make the component unavailable for use by legitimate clients.

Solution

• The P4 Client-side ServerSocket is now closed by default.
• A dedicated property p4.allow.server.mode has been introduced to open the server socket when necessary.
• Implement extra network-level protection measures as recommended in the SAP Security Guide.

To enable the ServerSocket on a standalone P4 client, configure one of the following:

• Set the InitialContext environment property p4.allow.server.mode to true.
• Set the Java system property -Dp4.allow.server.mode=true.

To prevent malicious access, apply server-side TLS configurations according to SAP Note 1527774 with authentication mode REQUIRE. Similarly, apply client-side TLS configurations from the same note on the looking-up P4 Clients.

Reason and prerequisites

The P4 protocol was designed to support both client and server logic in standalone P4 client processes. When a standalone P4 client needs to bind an object into the JNDI Registry of the remote AS Java, other P4 clients will connect to the binding P4 client to consume the implementation of the bound object. The binding P4 client acts as a P4 server and opens a ServerSocket without proper authentication, allowing attackers to connect and perform operations that can compromise the component.

CVSS

Score 6.9 Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

References

• CVE-2020-6263
• SAP Note 1527774