CVE-2020-26808
📋 TL;DR
This CVE describes a code injection vulnerability in SAP AS ABAP(DMIS) and SAP S4 HANA(DMIS) that allows authenticated attackers to execute arbitrary code. The vulnerability affects confidentiality, integrity, and availability of the application. Only authenticated users can exploit this vulnerability.
💻 Affected Systems
- SAP AS ABAP(DMIS)
- SAP S4 HANA(DMIS)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary code, access sensitive data, disrupt operations, and potentially pivot to other systems.
Likely Case
Data theft, application manipulation, or service disruption by authenticated malicious users or compromised accounts.
If Mitigated
Limited impact due to proper authentication controls, network segmentation, and monitoring preventing successful exploitation.
🎯 Exploit Status
Exploit details and proof-of-concept code are publicly available. Requires authenticated access but technical complexity is moderate for attackers with SAP knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 2973735
Vendor Advisory: https://launchpad.support.sap.com/#/notes/2973735
Restart Required: Yes
Instructions:
1. Download SAP Note 2973735 from SAP Support Portal. 2. Apply the correction instructions provided in the note. 3. Restart the affected SAP systems. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Restrict Function Module Access
allApply authorization controls to limit access to vulnerable function modules
Use SAP transaction SU24 to adjust authorization objects for affected function modules
Network Segmentation
allIsolate SAP systems from untrusted networks and implement strict firewall rules
🧯 If You Can't Patch
- Implement strict access controls and monitor for suspicious activity by authenticated users
- Deploy web application firewall (WAF) with SAP-specific rules to detect and block injection attempts
🔍 How to Verify
Check if Vulnerable:
Check SAP system version and verify if Security Note 2973735 is applied using transaction SNOTECheck Version:
Execute transaction SM51 to check SAP system version and kernel releaseVerify Fix Applied:
Verify Security Note 2973735 is successfully implemented and no errors in transaction SNOTE📡 Detection & Monitoring
Log Indicators:
- Unusual function module executions
- Authorization failures for sensitive transactions
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual SAP protocol traffic patterns
- Requests to vulnerable function modules from unexpected sources
SIEM Query:
source="sap_audit_log" AND (event_type="function_module_execution" AND module_name IN [vulnerable_modules])🔗 References
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
- http://seclists.org/fulldisclosure/2022/May/42
- https://launchpad.support.sap.com/#/notes/2973735
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
- http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html
- http://seclists.org/fulldisclosure/2022/May/42
- https://launchpad.support.sap.com/#/notes/2973735
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571
