Search

Unauthenticated potential RCE in FM_GPCR_OS_COMMAND P4 service

Impact On Business

An unauthenticated attacker with access to the P4 port of a SAP Solution Manager java-based instance, could be able to execute OS commands and potentially compromise the targeted system

Affected Components Description

Tested on following versions:

Java Kernel versions:

  • 7.50.3301.472568.20220902101413
  • 7.50.3301.467525.20210601093523
  • 7.50.3301.407179.20200416085516

 

SERVERCORE/CORE-TOOLS/J2EE-FRMW components versions:

  • 1000.7.50.24.7.20221009183400
  • 1000.7.50.22.0.20210804111800
  • 1000.7.50.2.0.20160125191600

 

SAP Solution Manager Diagnositc Agent version:

  • SMDAgent 7.20.11.5.20201030041628
  • SMDAgent 7.20.13.0.20210728040558

Vulnerability Details

The SAP Solution Manager exposes a service named SmdOsCmdBridge through P4 without prior authentication. Using this service, an unauthenticated attacker could exploit this missing authentication check to potentially end up executing OS commands in the Diagnostic Agent hosts connected to it.

Solution

SAP has released SAP Note 3305369 which provides patched versions of the affected components.

The patches can be downloaded from https://me.sap.com/notes/3305369.

Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.

Report Timeline

  • 01/25/2023: Vulnerability reported to vendor.
  • 01/25/2023: Vendor provides incident number.
  • 04/11/2023: Patch released.

References

Back to Advisories

Advisory Information

  • Public Release Date: 08/16/2024
  • Security Advisory ID: ONAPSIS-2024-0005
  • Researcher(s): Pablo Artuso

Vulnerability Information

  • Vendor: SAP
  • Affected Components:
    • SAP Java NetWeaver version 7.50
    • SAP Solution Manager DA 7.20 (Check SAP Note 3305369 for detailed information on affected releases)
  • Vulnerability Class: CWE-306: Missing Authentication for Critical Function
  • CVSS v3 score: 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
  • Risk Level: Critical
  • Assigned CVE: CVE-2023-27267
  • Vendor patch Information: SAP Security NOTE 3305369


ABOUT OUR RESEARCH LABS

Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications.

Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.

Find all reported vulnerabilities at:
https://github.com/Onapsis/vulnerability_advisories

This advisory is licensed under a Creative Commons 4.0 BY-ND International License

©2024 Onapsis | All rights reserved