High priority
SAP security note 2912939, "[CVE-2020-6275] Server Side Request Forgery vulnerability in SAP NetWeaver AS ABAP", is a note released on September 8, 2020. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP NetWeaver AS ABAP is vulnerable to Server Side Request Forgery (SSRF). An attacker can exploit this vulnerability by using inappropriate path names containing malicious server names in the import/export of sessions functionality. This can coerce the web server into authenticating with a malicious server, potentially compromising the confidentiality, integrity, and availability of the SAP database, especially if NTLM is configured.
An attacker with the necessary privileges can manipulate session imports/exports to interact with malicious servers, leading to credential compromise and unauthorized access to sensitive data.
Solution
Restrict the import and export functionality to logical path and file names only. Implement the specified Support Package or follow the respective correction instructions provided in the SAP Note.
Reason and prerequisites
- Database: must be Microsoft SQL Server.
- Privileges: the web server user or service account must have admin privileges on the MS SQL Server.
- SAP NetWeaver access: the attacker must have privileges to import sessions via Batch Imports in SAP NetWeaver.
CVSS
Score 7.6
Full note on SAP: SAP Support Launchpad note 2912939
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].