A cybersecurity firm has disclosed the details of critical SAP vulnerabilities, including a wormable exploit chain, that can expose organizations to attacks.
The vulnerabilities were reported to the enterprise software giant by Fabian Hagg, researcher at SEC Consult, an Austria-based cybersecurity consulting firm that is part of the Atos Group’s Eviden business. Hagg found the flaws as part of a research project that spanned three years, with patches being released by SAP in mid-2021 and January 2023.
The vulnerabilities are tracked as CVE-2021-27610, CVE-2021-33677, CVE-2021-33684 and CVE-2023-0014, and they impact products that use the SAP Application Server for ABAP component. This includes SAP ERP Central Component (ECC), S/4HANA, BW/4HANA, Solution Manager (SolMan), SAP for Oil & Gas, SAP for Utilities, Supplier Relationship Management (SRM), Human Capital Management (HCM), and Employee Central Payroll (ECP) products.
The issues, which include both design and implementation problems, were discovered during an analysis of the Remote Function Call (RFC) interface, which is designed for communication between SAP systems.
Two of the flaws have been assigned ‘critical’ severity ratings based on their CVSS score: CVE-2021-27610 and CVE-2023-0014.
Exploitation of the vulnerabilities discovered by Hagg can lead to a full system compromise. The attacker only needs network access to the targeted system.
Johannes Greil, head of the SEC Consult Vulnerability Lab, told SecurityWeek that the impacted systems are typically only reachable internally, but there may be certain products and configurations that could allow exploitation of the vulnerabilities directly from the internet. No user interaction or special permissions are required to exploit the flaws.
The vulnerabilities can be dangerous individually, but they pose an even greater risk when chained, making automated exploitation possible. The exploit chain was described as having wormable attack capabilities, enabling lateral movement in SAP environments.
While patches have been released by the vendor, organizations need to ensure that they have installed the fixes. SEC Consult recommends prioritizing systems exposed to untrusted networks. In addition to patches, configuration changes and “complex system adjustments” are required to address one of the flaws, the security firm explained.
“In case patching is not an option, we advise to limit network-wise access (RFC/HTTP) to vulnerable servers as far as possible in order to minimize the available attack surface. Furthermore, we advise to fully enforce encrypted server-to-server communications by means of HTTPS and SNC. Lastly, please refer to the additional measures described by the vendor in the corresponding SAP notes and in the FAQ for Security Note 3089413,” SEC Consult said.
Details of the vulnerabilities, along with a deep dive into the RFC protocol, are available in a paper published by SEC Consult. The company has also published a blog post summarizing the findings.
The research was also presented by Hagg on Thursday at the Troopers security conference in Germany.
Related: SAP Vulnerability Exploited in Attacks After Details Disclosed at Hacker Conferences
Related: Threat Actors Quick to Target (Patched) SAP Vulnerabilities
Related: SAP Patches High-Severity Vulnerabilities With June 2023 Security Updates
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Microsoft Adding New Security Features to Windows 11
- Sony Investigating After Hackers Offer to Sell Stolen Data
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
Latest News
- Microsoft Adding New Security Features to Windows 11
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
- Sony Investigating After Hackers Offer to Sell Stolen Data
- The CISO Carousel and its Effect on Enterprise Cybersecurity
- Xenomorph Android Banking Trojan Targeting Users in US, Canada
- $200 Million in Cryptocurrency Stolen in Mixin Network Hack
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
