CVE-2023-27500
📋 TL;DR
This vulnerability allows authenticated non-administrative users to exploit a directory traversal flaw in SAPRSBRO program to overwrite critical system files. This can lead to denial of service by making the operating system unavailable. Affects SAP systems with vulnerable versions of SAPRSBRO.
💻 Affected Systems
- SAP NetWeaver Application Server ABAP
- SAP NetWeaver Application Server Java
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability through overwriting of critical OS files, requiring system restoration from backups.
Likely Case
Targeted DoS attacks against specific SAP systems by overwriting configuration or system files.
If Mitigated
Limited impact with proper access controls and file system permissions in place.
🎯 Exploit Status
Exploitation requires authenticated access but directory traversal is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3302162
Vendor Advisory: https://launchpad.support.sap.com/#/notes/3302162
Restart Required: Yes
Instructions:
1. Download SAP Note 3302162 from SAP Support Portal. 2. Apply the correction instructions provided in the note. 3. Restart affected SAP instances.
🔧 Temporary Workarounds
Restrict SAPRSBRO access
allLimit access to SAPRSBRO program to only authorized administrative users.
SAP transaction PFCG to modify authorization profiles
File system permissions hardening
linuxImplement strict file system permissions to prevent overwriting of critical OS files.
chmod 644 /path/to/critical/files
chown root:root /path/to/critical/files
🧯 If You Can't Patch
- Implement strict access controls to limit SAPRSBRO program access to essential users only.
- Monitor file system changes and implement file integrity monitoring for critical OS files.
🔍 How to Verify
Check if Vulnerable:
Check if SAP Security Note 3302162 is applied using SAP Note Assistant or transaction SNOTE.Check Version:
Execute 'disp+work' in SAP GUI or check SAP_BASIS version in system information.Verify Fix Applied:
Verify SAP Note 3302162 implementation status and test SAPRSBRO functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SAPRSBRO program executions
- File modification attempts on system directories
Network Indicators:
- SAP GUI or RFC connections to SAPRSBRO from non-admin users
SIEM Query:
source="sap_audit_log" AND program="SAPRSBRO" AND user!="*ADMIN*"