Vulnerable SAP Systems Under Active Exploitation
A warning has been released by SAP to raise awareness of threat groups exploiting known vulnerabilities in unpatched systems.
Summary
A warning has been released by SAP to raise awareness of threat groups exploiting known vulnerabilities in unpatched systems.
Affected platforms
The following platforms are known to be affected:
Various SAP products including CRM, NetWeaver Application Server Java, and Solution Manager.
Threat details
Introduction
SAP has reported ongoing malicious activity targeting unpatched and misconfigured systems, which can disrupt critical business processes. Security researchers have found that there is often only a short time window to apply SAP security updates before attempts to exploit vulnerabilities are observed.
Vulnerabilities
The vulnerabilities being targeted have previously been addressed in security updates released by SAP. A remote attacker can exploit the vulnerabilities to take control of an affected system.
Several of the vulnerabilities affect the SAP NetWeaver Java technology stack, which is present in a wide range of SAP products.
For more information on the vulnerabilities please see the following SAP Security Notes (SAP ID required to access):
- Security Note 1445998
- Security Note 2258786
- Security Note 2234971
- Security Note 2296909
- Security Note 2547431
- Security Note 2890213
- Security Note 2934135
Researchers have also identified a pattern of brute force access attempts against default high-privilege user accounts, as their passwords are not always changed following installation.
Remediation advice
Organisations are encouraged to review SAP's Security Notes and News Article and apply security updates on a regular basis.
SAP recommends that systems with a significant delay in applying patches should be assessed for potential compromise, prioritising any internet-facing systems.
Systems should also be checked for any unsecured or unauthorised high-privilege user accounts. Accounts susceptible to brute force attacks if left with the default password include SAP*, SAPCPIC, TMSADM and CTB_ADMIN.
CVE Vulnerabilities
Last edited: 8 April 2021 2:55 pm