During the last 5 years, a lot of good presentations in the SAP Security area have been made. A lot of research has been done in different fields, from RFC vulnerabilities to SAPRouter and from SAPGUI to J2EE engine – and there is not enough place to describe them all. By this moment, more than 2000 SAP security notes have been published on SAP SDN portal. It is quite a few for one site and just the beginning from another site, which means that many bugs are still waiting for researchers.
So what kind of vulnerabilities can you find in SAP except well-known appsec issues like XSS, SQL Injections and Memory corruptions? In this talk we will show a demo of top 10 most interesting vulnerabilities found by the ERPScan researchers in SAP platform – from insecure encryption to interesting auth bypasses and from funny errors to very complex attack vectors. We will not concentrate on only one area but will show SAP platform insecurities from many different angles.
Many of those vulnerabilities were not disclosed before.
Top 10 most interesting SAP vulnerabilities and attacks