SAP on Insinuator.net - Bold Statements

#TR18 SAP Security Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 SAP Security Track.

SAP IGS : The ‘vulnerable’ forgotten component by Yvan Genuer

The Internet Graphics Server (IGS) is used to generate Web Based graphics from the SAP Web AS. Yvan Genuer looked at the security of an ancient component with very few public vulnerabilities available so far. In his talk he gave us insights on the structure of the IGS, its services, and problems he had when looking for documentation of the IGS and its components.

Information About SAP Security Note 2336795

Tue, 14 Mar 2017 00:00:00 +0000

Last year I encountered a slight variation of an internal port scan vulnerability for the CrystalReports component of SAP Business Objects. The original vulnerability was presented and disclosed by rapid7 in the talk “Hacking SAP Business Objects”. The corresponding slides can be found here.

Basically, the original vulnerability allowed port scanning of (internal) systems via the URL http://hostname/CrystalReports/viewrpt.cwr?id=$ID&wid=$WID&apstoken=ip:port@$TOKEN. By accessing this URL, different responses were received depending on if the port (parameter port in the URL) of the system (parameter ip in the URL) was in the state “open” or “closed”. The original vulnerability has been fixed a long time ago (SAP security note 1432881), but the fix did allow for a slight variation to make the attack work again.

2nd Rounds of TROOPERS17 Talks!

Wed, 14 Dec 2016 00:00:00 +0000

It is the end of the year and we are hoping it is not too hectic of a time for you all! But if it is, hopefully the announcement of our next round of TROOPERS17 talks is enough to get you in the TROOPERS (if not the holiday) spirit 🙂

Francis Alexander & Bharadwaj Machiraju: How we hacked Distributed Configuration Management Systems

With increase in necessity of distributed applications, coordination and configuration management tools for these classes of applications have popped up. These systems might pop-up occasionally during penetration tests. The major focus of this research was to find ways to abuse these systems as well as use them for getting deeper access to other systems.

Some infos about SAP Security Note 2258786

Thu, 30 Jun 2016 00:00:00 +0000

On the 8th of March SAP released the security note for a vulnerability we reported during an assessment of a SAP landscape. The issue affects the SAP NetWeaver Web Administration Interface. By knowing a special URL a malicious user can acquire version information about the services enabled in the SAP system as well as the operating system used. We wanted to share some details on the issue.

The vulnerability is a bypass of the HTTP Basic Authorization for the SAP Web Administration Interface. It discloses version information about the system respectively operating system, a brief SAP patch level overview and running services including their corresponding ports.

SAP Security @ Troopers16

Mon, 25 Apr 2016 00:00:00 +0000

When it comes to SAP, Troopers has two events that are about Security in SAP Systems in particular. On the first day of the Troopers16 Trainings the BIZEC workshop takes place. The second event is a dedicated SAP track during the conference. Apart from these events there were of course a lot of nice folks to talk to (about SAP) 🙂 This post is a short overview about SAP security @ TROOPERS16.

Patch Me If You Can

Sat, 02 Apr 2016 00:00:00 +0000

Right after the Opening Keynote of TROOPERS16, an informative and interesting talk took place at the SAP Security track. This talk was given by three speakers; Damian Poddebniak who is currently a master student at the University of Applied Sciences of Münster, Sebastian Schinzel who works as an IT security Professor at the University of Applied Sciences of Münster and he is also the founder of CycleSEC GmbH and finally the sixth-time speaker at Troopers “Andreas Wiegenstein” who is the CTO of Virtual Forge GmbH and a professional SAP security consultant since 2003.

Check your SAP landscape for default Solution Manager users

Thu, 10 Mar 2016 00:00:00 +0000

This is a guest post from Joris van de Vis @jvis, on his upcoming Troopers talk. Additional credits go to: Robin Vleeschhouwer, and Fred van de Langenberg.

As presented at Troopers this year, ERP-SEC research has uncovered a set of potential default accounts related to the use of SAP Solution Manager. These default accounts might pose a big risk to your SAP supported business as some of them have wide authorisations. It is therefore important to check if they exist in your landscape and change the default passwords.

XSS in SAP Netweaver

Fri, 24 Jan 2014 00:00:00 +0000

We just got credits for a flaw we found in SAP Netweaver. The issue is a reflected Cross-Site Scripting (XSS). It can be triggered in the administrative interface for the Internet Communication Manager (ICM) and Web Dispatcher. This means that the targets for this XSS will definitely be users with administrative privileges. This makes it especially juicy for an attacker.

SAP rated the vulnerability with CVSS and a Base Score of 4.3 having a Base Vector of AV:N/AC:M/AU:N/C:N/I:P/A:N. Which again opens the discussion on how to rate the impact of XSS by using CVSS. CVSS states that XSS “should be scored with no impact to confidentiality or availability, and partial impact to integrity“, which is clearly arguable. Especially when thinking of the impact on confidentiality. As you might know by now, we tried to tackle the problem of rating vulnerabilities ourselves with the ERNW Rapid Rating System (ERRS) and it was not an easy task. 😉 However, SAP states that this is a correction with high priority, so you should apply the patches as soon as possible.

Latest SAP threats, SAP Forensics & BIZEC @Troopers!

Wed, 27 Feb 2013 00:00:00 +0000

This is a guest post from Mariano Nunez and Juan Perez-Etchegoyen

Juan Perez-Etchegoyen (@jp_pereze) and Mariano Nunez (@marianonunezdc) from Onapsis here, thrilled to be troopers for the third time! In this post we want to share with you a glimpse of what you will see regarding SAP security at this amazing conference.

Last week we released advisories regarding several vulnerabilities affecting SAP platforms. Some of these vulnerabilities are in fact very critical, and their exploitation could lead to a full-compromise of the entire SAP implementation – even by completely anonymous attackers. Following our responsible disclosure policy, SAP released the relevant SAP Security Notes (patches) for all these vulnerabilities a long time ago, so if you are an SAP customer make sure you have properly implemented them!

ERP Platforms Are Vulnerable

Thu, 08 Mar 2012 00:00:00 +0000

This is a guest post by the SAP security expert Juan Pablo Perez-Etchegoyen, CTO of Onapsis. Enjoy reading:

At Onapsis we are continuously researching in the ERP security field to identify the risks that ERP systems and business-critical applications are exposed to. This way we help customers and vendors to increase their security posture and mitigate threats that may be affecting their most important platform: the one that stores and manages their business’ crown jewels.

Diving Into Real-World Security Threats to SAP Systems

Wed, 01 Feb 2012 00:00:00 +0000

This is a guest post by the SAP security experts of BIZEC. Enjoy reading:

On March 20^(th), the first BIZEC workshop will be held at the amazing Troopers conference in Heidelberg, Germany. For those still unfamiliar with BIZEC: the business application security initiative is a non-profit organization focused on security threats affecting ERP systems and business-critical infrastructures.

The main goals of BIZEC are:

Raise awareness, demonstrating that ERP security must be analyzed holistically.
Analyze current and future threats affecting these systems.
Serve as a unique central point of knowledge and reference in this subject.
Provide experienced feedback to global organizations, helping them to increase the security of their business-critical information.
Organize events with the community to share and exchange information.

The “BIZEC workshop at Troopers 2012” will dive into the security of SAP platforms. Still to this day, a big part of the Auditing and Information Security industries believe that Segregation of Duties (SoD) controls are enough to protect these business-critical systems.
By attending this session, InfoSec professionals and SAP security managers will be able to stop “flying blind” with regards to the security of their SAP systems. They will learn why SoD controls are not enough, which current threats exist that could be exploited by evil hackers, and how to protect their business-critical information from cyber-attacks.