Search

MS_ACL_INFO bypass under special conditions

Impact On Business

The Message Server is a central component of every SAP system. When, certain conditions are met (listed in a further section) the ACL INFO stops working and therefore any unauthenticated attacker can register new application servers (10Kblaze attack).

Affected Components Description

Every Message Server binary between SAP Kernel versions 7.22 and 7.77.

Vulnerability Details

The SAP Message Server is a central component of an SAP system. Most of the core configuration of this component is made trought the Internal port. It was found that because of an memory aliasing problem, when certain conditions are met, the value inside an OS register is wrongly written. As a consequence, a the condition of a further “if” statement returns always TRUE, making the ACL protection useless. In other words, the ACL_INFO (ACL that controls which hosts are able to register new application servers) works as an “allow everything”.

The conditions that need to be met are:

  • At least, one of the allowed hosts inside ACL_INFO is an IP address.
  • The configured trace level is > 1.
  • system/secure_communications is set to OFF.

Solution

SAP has released SAP Note 3344295 which provides patched versions of the affected components.

The patches can be downloaded from https://me.sap.com/notes/3344295.

Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.

Report Timeline

  • 05/24/2023: Onapsis reports vulnerability to SAP
  • 05/24/2023: SAP acknowledges the report
  • 08/08/2023: SAP issues the patch.

References

Back to Advisories

Advisory Information

  • Public Release Date: 08/16/2024
  • Security Advisory ID: ONAPSIS-2024-0006
  • Researcher(s): Pablo Artuso & Hernan Formoso

Vulnerability Information

  • Vendor: SAP
  • Affected Components:
    • SAP Message Server from kernel 7.22 to 7.77

Check SAP Note 3344295 for detailed information on affected releases)

  • Vulnerability Class: CWE-306: Missing Authentication for Critical Function
  • CVSS v3 score: 7.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
  • Risk Level: High
  • Assigned CVE: CVE-2023-37491
  • Vendor patch Information: SAP Security NOTE 3344295


ABOUT OUR RESEARCH LABS

Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications.

Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.

Find all reported vulnerabilities at:
https://github.com/Onapsis/vulnerability_advisories

This advisory is licensed under a Creative Commons 4.0 BY-ND International License

©2024 Onapsis | All rights reserved