SAP NetWeaver AS ABAP up to 754 Import/Export server-side request forgery

Summaryinfo

A vulnerability labeled as critical has been found in SAP NetWeaver AS ABAP up to 754. Affected by this vulnerability is an unknown functionality of the component Import/Export. Such manipulation leads to server-side request forgery. This vulnerability is referenced as CVE-2020-6275. The attack needs to be initiated within the local network. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in SAP NetWeaver AS ABAP up to 754 (Solution Stack Software). Affected by this issue is an unknown part of the component Import/Export. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where in an attacker can use inappropriate path names containing malicious server names in the import/export of sessions functionality and coerce the web server into authenticating with the malicious server. Furthermore, if NTLM is setup the attacker can compromise confidentiality, integrity and availability of the SAP database.

The weakness was published 06/10/2020. This vulnerability is handled as CVE-2020-6275 since 01/08/2020. The exploitation is known to be difficult. The attack needs to be done within the local network. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/11/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-156528. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Solution Stack Software

Vendor

• SAP

Name

• NetWeaver AS ABAP

Version

• 700
• 701
• 702
• 710
• 711
• 730
• 731
• 740
• 750
• 751
• 752
• 753
• 754

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion