Skip to main content

SAP SolMan Critical vulnerability detected and attackers have begun probing for vulnerable SAP systems.

Automated probes for servers containing a severe vulnerability in SAP software have been detected a week after a working exploit was published online. 

The vulnerability, tracked as CVE-2020-6207, is a bug in SAP Solution Manager (SolMan), version 7.2. 

The vulnerability has been awarded a CVSS base score of 10.0 -- the highest severity rating available -- and is caused by a missing authentication check.

SolMan's End user Experience Monitoring (EEM) function contained the authentication issue. EEM can be used to deploy scripts in other systems, and as a result, compromising EEM can lead to the hijack of "every system" connected to SolMan via remote code execution (RCE) 

SAP issued a patch for CVE-2020-6207 in March 2020 (SAP Security Note #2890213). However, for any servers left unpatched, there is now a heightened risk of compromise with the public release of a working Proof-of-Concept (PoC) exploit code.

Last week, Dmitry Chastuhin released a PoC for CVE-2020-6207 as a project for educational purposes. The security researcher said the script "check[s] and exploit[s] missing authentication checks in SAP EEM servlet."

 If enterprise IT staff have applied the patch, there is no need for concern. However, if the security fix is yet to be implemented and SolMan setups are exposed online, the creation of automated exploit tools should spur admins on to resolve the security flaw as quickly as possible. 

References to Advisories


https://launchpad.support.sap.com/#/notes/2890213

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305



Comments

Post a Comment

Popular posts from this blog

Understanding Ransomware

Ransomware is a type of malicious software designed to encrypt or block access to a victim's files or entire computer system. The attackers demand a ransom payment, typically in cryptocurrencies, in exchange for providing the decryption key or restoring access. This insidious form of cyberattack has evolved over the years, becoming more sophisticated and causing significant disruption.   The impact of ransomware attacks can be devastating on multiple levels. For individuals, it can result in the loss of personal data, compromising sensitive information like financial records or personal documents. In businesses, ransomware can disrupt operations, leading to financial losses, reputational damage, and potential legal implications. Critical infrastructure, such as healthcare or government systems, can also become targets, risking public safety and national security.
Post a Comment
Read more

Information security !!!

 
Post a Comment
Read more

How to clear CISSP

Familiarize yourself with the exam content: The CISSP exam covers a wide range of topics, including security and risk management, asset security, security engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security. It's important to have a solid understanding of all of these areas in order to be successful on the exam. Review the exam objectives: The CISSP exam objectives are published by (ISC)², the organization that administers the certification. Reviewing these objectives will help you understand the specific areas that the exam will test. Study the (ISC)² CISSP Common Body of Knowledge (CBK): The CISSP CBK is a comprehensive guide to the knowledge and skills that are required for the certification. It covers all of the exam domains in detail and is a valuable resource for exam preparation. Take a study course or use study materials: There are many study courses and mate...
Post a Comment
Read more