Today, almost all critical operations like procurements, stock resources management, human resources management, financial reports and much more, and all the data related to them, are stored in SAP system. This is why the main target for an insider or an external attacker would be to gain illicit access to SAP with the purpose of malicious manipulation of company resources. In spite of the increasing popularity of ERP systems security in the security community, companies are still vulnerable to cybercriminal and insider attacks. At this moment SAP has released more than 2000 Security notes closing various vulnerabilities, which is quite a lot, especially if you keep in mind that sometimes it is enough to get access to all business critical data through only one issue. An example was presented at BlackHat last summer. On the other side, almost every company develops custom ABAP code which can also have vulnerabilities and backdoors left by developers - said Alexander Polyakov, CTO of ERPScan.

On the BlackHat Europe conference held from March 14 to March 16, Alexey Sintsov, head of information security audit department in ERPScan Company, shared his experience in penetration testing and presented the results of a recently conducted research of Lotus Domino security.

His presentation told about lack of time and frequently desire for companies to dig into the details of existing vulnerabilities to exploit them, and how it often impairs the quality of their work.

In the demonstration, a private vulnerability in Lotus Domino was quite quickly disassembled, the resulting exploit used, the existing patch bypassed and a critical 0-day vulnerability found. The result was an attack on the Domino Controller service (the Lotus Domino administration service) which allows full server compromise.

Vulnerable services were also exposed which, one would suppose, should not be accessible from the Internet. Moreover, in the course of the research, services with the 0-day vulnerability and ever older vulnerabilities were found on the USA government servers (the .gov domain), on the servers of Russian universities and, curiously enough, even in the corporate network of IBM itself.

Thus, it can be concluded that penetration threats are quite easily actualized for pretty much any network; even governments and corporate giants are vulnerable to attacks from the Internet, such as those made by LulzSec and Anonymous.

Links to vulnerabilities:

Alexey’s presentation can be found here.

His presentation told about lack of time and frequently desire for companies to dig into the details of existing vulnerabilities to exploit them, and how it often impairs the quality of their work.

In the demonstration, a private vulnerability in Lotus Domino was quite quickly disassembled, the resulting exploit used, the existing patch bypassed and a critical 0-day vulnerability found. The result was an attack on the Domino Controller service (the Lotus Domino administration service) which allows full server compromise.

Whitepaper "Lotus Domino: Penetration Through the Controller", BlackHat Europe 2012

His presentation told about lack of time and frequently desire for companies to dig into the details of existing vulnerabilities to exploit them, and how it often impairs the quality of their work.

In the demonstration, a private vulnerability in Lotus Domino was quite quickly disassembled, the resulting exploit used, the existing patch bypassed and a critical 0-day vulnerability found. The result was an attack on the Domino Controller service (the Lotus Domino administration service) which allows full server compromise.

"Lotus Domino: Penetration Through the Controller", BlackHat Europe 2012

SAP has released monthly critical patch update for March 2012. This patch update closes many vulnerabilities in SAP products. Overall, more than 40 vulnerabilities were fixed, including 7 found by third-party researchers. Also, this month, 2 vulnerabilities found by ERPScan researchers Dmitriy Chastukhin and Alexey Tyurin were closed.

I would like to tell you more about the corrected vulnerabilities and the risks that they involve.

1. (1607850) SAP BW – critical information disclosure. No details are available. Criticality, according to CVSS, is 7.5.
2. (1580244) SAP BASIS – missing authorization check in an RFC function. Criticality, according to CVSS, is 3.5.
3. (1656549) SAP Portal – XSS vulnerability. An attacker can use the XSS vulnerability by sending a link to malicious script to an unaware user via an e-mail, messaging or social networks. Thus, an attacker can gain access to user session and gain control over business-critical information which can be accessed by victim. Criticality, according to CVSS, is 4.3.
4. (1657891) SAP BASIS – missing authorization checks in RFC function. Criticality, according to CVSS, is 2.3. An attacker can execute vulnerable transaction, program or RFC function remotely without authentication because authorization check is missing. It can lead to different threats from information disclosure to full system compromise.
5. (1591427) SAP BASIS – XSS vulnerability. Criticality, according to CVSS, is 4.3.
6. (1658947) SAP Portal – information disclosure. Criticality, according to CVSS, is 4.0.
7. (1600755) SAP HR – ABAP code injection through missing input validity checks. Criticality, according to CVSS, is 6.0.

Today I will tell you about one of the most popular vulnerabilities, namely the missing authorization checks in RFC functions.

Overall, it is one of the most popular and most easily understandable types of vulnerabilities. Think about some RFC function which fulfills some critical action in the system; call it, for example, Z_RFCEXPLOIT (actually, the same applies to reports and transactions). The vulnerability is in the missing user authorization check (AUTHORITY-CHECK) in its code. In practice, it means that the Z_RFCEXPLOIT function can be called by any user, provided that he or she has sufficient privileges to call RFC functions at all.

There are 3 basic ways to call an RFC function.

1. In the dialog mode, using the SE37 transaction.
Privileged users usually have the rights for this kind of transaction though exceptions certainly exist.

2. Through remote call by RFC protocol
In this case, apart from authorization check for RFC function per se, system also checks that user has the right to access the RFC functions group (S_RFC authorization, FUGR field). This mitigates the risk of attack, but the risk remains in the case of high privileged accounts with default passwords, like SAP*, DDIC, EARLYWATCH, TMSADM or SAPCPIC.
It is notable that the last two accounts are found in % 95 of the systems we analyze, so the chances of attack are pretty high.

3. Though remote call by WEBRFC
It is commonly known that RFC commands can be called remotely through web interface located on the web port of SAP NetWeaver ABAP application server (relative address: /sap/bc/soap/rfc). What is specific about this method is that, first, in many organizations web interface is accessible through the Internet, and second, group authorization is not checked when calling an RFC function through this interface, which allows any user to make vulnerable RFC calls.

Thus, vulnerabilities connected with missing authorization should not be underestimated because they are easily exploited and do not require special privileges in the system. Taking into account that there are about 2 million RFC functions in SAP, such vulnerabilities will constantly reappear in SAP products, as well as in self-developed code whose security should be thoroughly cared about.

PS: According to ERPScan’s agreement with SAP we do not publish details of vulnerabilities until 3 months since update is released to give organizations time to install the patch.

ERPScan Security Scanner for SAP is an innovative product for integrated assessment of SAP platform security and standard compliance. The system enables conducting complex security assessments while scanning SAP servers for software vulnerabilities, misconfigurations, critical access, and also performs assessment for compliance to current standards and best practices including SAP best practices and ISACA guidelines.

Detailed list of corrected vulnerabilities is below:

• An XSS vulnerability was found in SAP Portal. An attacker can use the XSS vulnerability by sending a link to malicious script to an unaware user via an e-mail, messaging or social networks. Thus, an attacker can gain access to user session and gain control over business-critical information which can be accessed by victim. Update is available in SAP Note 1656549. Criticality, according to CVSS, is 4.3.
• Missing authorization checks in RFC function from BASIS module. Update is available in SAP Note 1657891. Criticality, according to CVSS, is 2.3. An attacker can execute vulnerable transaction, program or RFC function remotely without authentication because authorization check is missing. It can lead to different threats from information disclosure to full system compromise.

SAP has traditionally published acknowledgements for found vulnerabilities to security researchers from DSecRG on their acknowledgement page.

It is highly recommended to patch all those issues to prevent business risks.

Advisories for those issues with technical details will be available within 3 months on ERPScan.com and also on DSecRG.com.