[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] =?utf-8?q?SEC_Consult_Vulnerability_Lab_Whitepaper=3A_Everyo?= =?utf-8?q?ne_Knows_SAP=C2=AE=2C_
From:       "SEC Consult Vulnerability Lab, Research via Fulldisclosure" <fulldisclosure () sec
Date:       2023-06-29 14:12:29
Message-ID: 54af9023-299d-7732-608c-abe4fdbb7fff () sec-consult ! com
[Download RAW message or body]

SEC Consult Vulnerability Lab Whitepaper < 20230629-0 >
=======================================================================
                      Title: Everyone Knows SAP ®, Everyone Uses SAP,
                             Everyone Uses RFC, No One Knows RFC:
                             From RFC to RCE 16 Years Later
                      Researcher: Fabian Hagg (Office Vienna)
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Eviden business
                      Europe | Asia

                      https://www.sec-consult.com
=======================================================================

In an independent analysis on the server-side implementation of the proprietary
Remote Function Call (RFC) interface in SAP NetWeaver Application Server ABAP
and ABAP Platform (both hereinafter referred to as AS ABAP), a set of high-impact
implementation bugs and design flaws were identified by SEC Consult Vulnerability
Lab security researcher and SAP security expert Fabian Hagg. Technical details
about the research results are presented during the annual Troopers Security
Conference 2023 in Heidelberg, Germany.

Remote Function Call (RFC) is a proprietary communication protocol required for
all systems operating the SAP ® Application Server for ABAP ®, making it one of the
most appealing targets for attacks on business-critical SAP system landscapes.
With the talk "Attacking the Giants: Exploiting SAP Internals" presented by M.
Nunez at Black Hat Europe 2007, the protocol reached the security research community
for the first time. Nowadays, SAP systems became increasingly interconnected not
only internally, but also across network trust boundaries. This circumstance results
in enterprises relying on the RFC interface technology and its codebase more than
ever.

The present paper reports on an independent analysis of the protocol as it is used
in SAP NetWeaver ® Application Server ABAP and ABAP Platform for server-to-server
communication of type '3'. By employing a hybrid security testing approach combining
static and dynamic analysis techniques, the objective of this research in re-assessing
the RFC attack surface yielded alternate logon material, cryptographic failures,
memory corruptions, and ABAP programming pitfalls. This paper examines each of the
identified vulnerabilities, demystifying somewhat forgotten inner workings of the
protocol and key security mechanisms to highlight novel attack vectors and a wormable
exploitation chain.

Technical whitepaper: https://r.sec-consult.com/saprfcwhite
Short blog post summary: https://r.sec-consult.com/saprfcblog
TROOPERS23 conference page: https://troopers.de/troopers23/talks/n7yuqg/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Eviden business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Eviden business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]