Threat Advisory: Critical Vulnerability in SAP NetWeaver AS Java (CVE-2020-6287)
July 17, 2020
SAP has released a security update to address the critical vulnerability, CVE-2020-6287, discovered in the SAP NetWeaver Application Server (AS) Java component LM Configuration Wizard. This vulnerability is found in SAP applications running NetWeaver AS Java 7.3 up to 7.5. Since the SAP NetWeaver AS for Java supports the SAP Portal component (which is commonly exposed to the Internet), it is possible that this vulnerability is publicly exposed as well.
The vulnerability is caused by a lack of authentication in a web component of SAP NetWeaver AS for Java that allows high-privileged activities on the SAP system. Threat actors can gain unrestricted access by creating user accounts and using them to execute operating system commands with the privilege level of the SAP service account which has unrestricted access to the SAP database and the ability to perform application maintenance actions.
Successful exploitation of this vulnerability via the Hypertext Transfer Protocol (HTTP) allows an unauthenticated user to take control of trusted SAP applications, leading to the SAP NetWeaver Application Server being compromised.
Herjavec Group highly recommends that organizations apply the patch immediately due to the criticality of the vulnerability and the expanded attack surface. If organizations are unable to patch affected systems, the vulnerability can also be mitigated by disabling the LM Configuration Wizard service. Monitoring SAP NetWeaver AS for anomalous activity is highly advised.