SAP Security Note
High priority
SAP security note 2500044, “Full access to SAP Management Console”, is a program error note released on 14.11.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A private key for instance communication is stored in Java, and an attacker might be able to access this key. This vulnerability poses a significant security risk, as unauthorized access to the private key can lead to full access to the SAP Management Console.
Solution
Starting with the new patch, setting the instance profile variable jstartup/secure_key=1 implements a new key management system. All existing methods are retained for backward compatibility and can be activated with jstartup/secure_key=0.
Reason and prerequisites
To exploit this vulnerability, an attacker would need development and deployment rights on your J2EE instance, such as in JSP development. Additionally, the attacker would need knowledge of how to insert the private key into requests.
CVSS
Score 8.0 Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected components
- SAP KERNEL 7.53 64-BIT UNICODE
- SAP KERNEL 7.53 64-BIT
- SAP KERNEL 7.49 64-BIT UNICODE
- SAP KERNEL 7.49 64-BIT
- SAP KERNEL 7.45 64-BIT UNICODE
- SAP KERNEL 7.45 64-BIT
Full note on SAP: SAP Support Launchpad note 2500044
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].