CVE-2023-24523
📋 TL;DR
This vulnerability allows authenticated non-admin users with local access to SAP Host Agent ports to execute arbitrary operating system commands with administrator privileges. Attackers can read/modify any data or make systems unavailable. Affects SAP Host Agent versions 7.21 and 7.22.
💻 Affected Systems
- SAP Host Agent (Start Service)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative command execution leading to data theft, system destruction, or ransomware deployment.
Likely Case
Privilege escalation from authenticated user to administrator leading to data exfiltration or system manipulation.
If Mitigated
Limited impact due to network segmentation and strict access controls preventing local access to vulnerable ports.
🎯 Exploit Status
Exploitation requires crafting a ConfigureOutsideDiscovery request with OS commands. Authentication as non-admin user is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Note 3285757 patches
Vendor Advisory: https://launchpad.support.sap.com/#/notes/3285757
Restart Required: Yes
Instructions:
1. Download patches from SAP Note 3285757. 2. Apply patches to affected SAP Host Agent installations. 3. Restart SAP Host Agent services.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to SAP Host Agent ports to only trusted administrative systems
Use firewall rules to block non-admin access to SAP Host Agent ports (default 1128-1129)
Access Control
allLimit user accounts with access to SAP Host Agent services
Review and restrict user permissions for SAP Host Agent access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SAP Host Agent ports from non-admin users
- Monitor for unusual ConfigureOutsideDiscovery requests in SAP Host Agent logs
🔍 How to Verify
Check if Vulnerable:
Check SAP Host Agent version using 'saphostexec -version' and verify if running 7.21 or 7.22Check Version:
saphostexec -versionVerify Fix Applied:
Verify patch application by checking version after applying SAP Note 3285757 and confirming version is updated📡 Detection & Monitoring
Log Indicators:
- Unusual ConfigureOutsideDiscovery requests in SAP Host Agent logs
- Commands executed with unexpected privileges
Network Indicators:
- Unauthorized access attempts to SAP Host Agent ports (1128-1129)
- Suspicious network traffic to SAP Host Agent services
SIEM Query:
source="sap_host_agent" AND (event="ConfigureOutsideDiscovery" OR command_execution)