CVE-2021-21484
📋 TL;DR
This vulnerability allows attackers to bypass LDAP authentication in SAP HANA Database when the LDAP directory server is configured to permit unauthenticated binds. Attackers can gain unauthorized access to the database without valid credentials. Organizations using SAP HANA Database version 2.0 with LDAP authentication are affected.
💻 Affected Systems
- SAP HANA Database
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the SAP HANA database, allowing attackers to access, modify, or exfiltrate sensitive data, execute arbitrary commands, or disrupt operations.
Likely Case
Unauthorized access to database contents, potentially leading to data theft, privilege escalation, or lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, monitoring, and access controls are implemented alongside patching.
🎯 Exploit Status
Exploitation requires network access to the SAP HANA instance and knowledge of LDAP configuration weaknesses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Note 3017378
Vendor Advisory: https://launchpad.support.sap.com/#/notes/3017378
Restart Required: Yes
Instructions:
1. Download and apply SAP Note 3017378. 2. Restart SAP HANA services. 3. Verify LDAP directory server does not allow unauthenticated binds.
🔧 Temporary Workarounds
Disable LDAP unauthenticated binds
allConfigure the LDAP directory server to reject unauthenticated bind requests.
# LDAP server configuration varies by vendor - consult your LDAP server documentation
Use alternative authentication
allTemporarily switch to database-native authentication instead of LDAP.
# Modify SAP HANA authentication configuration to use internal authentication
🧯 If You Can't Patch
- Implement strict network access controls to limit access to SAP HANA Database ports
- Enable comprehensive logging and monitoring for authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check if SAP HANA version is 2.0 and LDAP authentication is configured. Verify LDAP server allows unauthenticated binds using LDAP testing tools.Check Version:
SELECT * FROM M_DATABASE;Verify Fix Applied:
Confirm SAP Note 3017378 is applied and test authentication with invalid credentials to ensure it fails.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts from unexpected sources
- Successful logins without proper authentication events in LDAP logs
Network Indicators:
- LDAP bind requests without credentials to the directory server
- Database connections from unauthorized IP addresses
SIEM Query:
source="hana_audit_log" AND (event="authentication_failure" OR event="authentication_success") | stats count by src_ip, user