SAP Host Agent – SAPOscol Namespace – Missing authentication
Impact On Business
Successful attacks lead to information disclosure as well as extend the scope for an attacker.
Affected Components Description
The SAP Host Agent can accomplish several life-cycle tasks like : operating system monitoring, database monitoring, system instance control or upgrade preparation. Installed automatically during the installation of the new SAP system, it’s an OS independent and mandatory application.
Vulnerability Details
The parameter service/localconnection disables authentication for SAP Start Service if it is set to value “compat”. Most of the web methods exposed by this service also check for authorization and reject requests if it is performed by an anonymous user. But few methods do not check for authorization. It is possible to request them remotely and anonymously. Among of them :
- SAPOscol : GetVersion
- SAPOscol : GetOsData
- SAPOscol : GetHwConfXML
- SAPOscol : GetHwConfText
- SAPHostControl : GetComputerSystem
- SAPHostControl : ListDatabases
Solution
SAP has released SAP Note 3358328 which provides patched versions of the affected components.
The patches can be downloaded from https://me.sap.com/notes/3358328.
Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.
Report Timeline
- 10/28/2022: Onapsis sends details to SAP
- 11/03/2022: SAP reject the submission
- 11/03/2022: Onapsis kindly ask to reconsider it
- 01/05/2023: SAP reject the submission
- 01/20/2023: Onapsis kindly ask to review it again with more information
- 01/31/2023: SAP still reject the submission, but they plan to release a note documenting the security-risk of it
- 01/31/2023: Onapsis agreed, as long as the documentation was clear in term of risk
- 06/15/2023: Onapsis asks for the documentation
- 07/04/2023: Onapsis asks for the documentation
- 08/08/2023: SAP releases SAP Note fixing the issue
References
- Onapsis blogpost: https://onapsis.com/blog/sap-security-patch-day-august-2023/
- CVE Mitre: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36926
- Vendor Patch: https://me.sap.com/notes/3358328
Advisory Information
- Public Release Date: 07/18/25
- Security Advisory ID: ONAPSIS-2024-0014
- Researcher(s): Yvan Genuer
Vulnerability Information
- Vendor: SAP
- Affected Components:
- SAP Host Agent 7.22
- SAPHOSTAGENT 7.22 SP060 and lower
(Check SAP Note 3358328 for detailed information on affected releases)
- Vulnerability Class: CWE-287 CWE-200
- CVSS v3 score: 3.7 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Risk Level: Low
- Assigned CVE: CVE-2023-36926
- Vendor patch Information: SAP Security NOTE 3358328
ABOUT OUR RESEARCH LABS
Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications.
Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.
Find all reported vulnerabilities at:
https://github.com/Onapsis/vulnerability_advisories
This advisory is licensed under a Creative Commons 4.0 BY-ND International License