CVE-2016-6145 in HANA
Summary
by MITRE
The SQL interface in SAP HANA provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailed_error_on_connect option is not supported or is configured as "False," which allows remote attackers to enumerate database users via a series of login attempts, aka SAP Security Note 2216869.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/22/2019
The vulnerability described in CVE-2016-6145 represents a critical information disclosure flaw within SAP HANA's SQL interface that fundamentally compromises the system's authentication security model. This weakness arises from the inconsistent error messaging behavior during login attempts, creating a predictable pattern that attackers can exploit to systematically identify valid user accounts within the database system. The vulnerability specifically manifests when the detailed_error_on_connect option is either unsupported or configured with a "False" value, which inadvertently exposes information about user account status to unauthorized parties. This flaw directly violates fundamental security principles by providing attackers with actionable intelligence about the target system's user base through simple reconnaissance techniques.
The technical implementation of this vulnerability stems from SAP HANA's authentication mechanism design where the system generates different error responses based on whether a username exists in the system and whether that account is locked or disabled. When the detailed_error_on_connect option is disabled, the system returns generic error messages that fail to obscure the distinction between non-existent accounts and locked accounts, creating a side-channel attack vector. Attackers can systematically submit login attempts with various username combinations and observe the different error responses to determine which accounts are valid and potentially active within the system. This behavior creates a user enumeration attack surface that can be leveraged to build comprehensive user dictionaries for subsequent attacks, including brute force attempts against identified valid accounts.
The operational impact of this vulnerability extends beyond simple user enumeration, as it provides attackers with foundational intelligence for more sophisticated attack vectors. Once valid user accounts are identified, attackers can proceed with credential stuffing, brute force attacks, or targeted password spraying campaigns against the discovered accounts. The vulnerability also enables attackers to determine account lockout patterns and potentially identify account status information, which can be used to plan more effective attacks or avoid detection mechanisms. This information disclosure directly undermines the principle of least privilege and weakens the overall security posture of SAP HANA systems, particularly in environments where user account management and authentication controls are critical for data protection. The vulnerability affects organizations that have not properly configured the detailed_error_on_connect option, leaving them exposed to reconnaissance activities that can significantly increase their attack surface.
Organizations should implement immediate mitigations to address this vulnerability by configuring the detailed_error_on_connect option to "True" or ensuring that appropriate rate limiting and account lockout mechanisms are in place to prevent systematic enumeration attacks. The configuration change should be implemented across all SAP HANA systems and monitored for compliance. Additionally, organizations should review their authentication policies and implement multi-factor authentication mechanisms to provide additional layers of protection beyond basic credential validation. Network segmentation and access control measures should be strengthened to limit the potential impact of successful exploitation, while regular security assessments should be conducted to identify similar vulnerabilities in other systems. This vulnerability aligns with CWE-200, which addresses information exposure, and represents a classic example of how improper error handling can create security weaknesses that violate fundamental security principles. The attack vector corresponds to techniques documented in the ATT&CK framework under credential access and reconnaissance phases, emphasizing the importance of proper error handling and access control configurations in database security.