what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

SAP E-Recruiting Email Verification Bypass

SAP E-Recruiting Email Verification Bypass
Posted Sep 13, 2017
Authored by Marc Nimmerrichter | Site sec-consult.com

SAP E-Recruiting versions 605, 606, 616, and 617 suffer from an email verification bypass vulnerability.

tags | exploit, bypass
SHA-256 | f7872424a2554686226a1a479c765245cbc5fb05e0518567d3bfd78a6384b4bc

SAP E-Recruiting Email Verification Bypass

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20170912-0 >
=======================================================================
title: Email verification bypass
product: SAP E-Recruiting
vulnerable version: 605, 606, 616, 617
fixed version: see SAP security note number 2507798
impact: medium
homepage: https://www.sap.com
found: 2017-07-12
by: Marc Nimmerrichter (Office Vienna)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult
Berlin - Frankfurt/Main - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"SAP E-Recruiting" has recruitment and succession planning instruments that
will help your company find new employees, employ them in positions that suit
their capabilities, promote their professional development, and retain them in
the long term.
As well as enabling you to handle your companyas applicant tracking activities,
"SAP E-Recruiting" ensures that you drive up-to-date human resources management,
by proactively maintaining contact with applicants, potential candidates, and
consequently, with your employees.

Source:
https://help.sap.com/saphelp_erp60_sp/helpdata/en/73/8bcf535b804808e10000000a174cb4/frameset.htm


Business recommendation:
------------------------
Email address verification during the applicant registration can be bypassed.
Businesses using the vulnerable component are advised to estimate the impact of
insufficient email address verification on their business processes and react
accordingly. It is recommended to install a patched version as soon as possible.


Vulnerability overview/description:
-----------------------------------
When an external applicant registers to the E-Recruiting application, he/she
receives a link by email to confirm access to the provided email address.
However, this measure can be bypassed and attackers can register and confirm
email addresses that they do not have access to.

An attacker could register email addresses not belonging to him/her. This could
have a business impact, because business processes might rely on a verified
email address. Furthermore, since an email address can be registered only once,
an attacker could prevent other legitimate users from registering to the
E-Recruiting application.


Proof of concept:
-----------------
The email verification link contains the "param" HTTP GET parameter with base64
encoded data. When decoded, this data contains the parameters
"candidate_hrobject" and "corr_act_guid". candidate_hrobject is an incremental
user ID. corr_act_guid is a random value that needs to be provided during the
email verification. However, this value is not bound to the current
registration, which means that the value of a previous registration can be
reused. Since candidate_hrobject is incremental, it can be guessed by an
attacker. An attacker who wants to register with an email address not belonging
to him/her, could simply do the following:

1. Register with his own email address
2. Directly afterwards register with someone else's email address
3. Read the current value of candidate_hrobject in the confirmation
link from the first registration
4. Increment this value by 1
5. Send the new value in the HTTP GET request, use the corr_act_guidparameter
from the first registration
6. If this did not work: go back to step 4 to try the next ID
(maybe other people registered in between the two registrations)

This attack works because there is no per-registration nonce in the
confirmation link.


Vulnerable / tested versions:
-----------------------------
The vulnerability was found in the following release of E-Recruiting (ERECRUIT):
Release: 617

According to the vendor, the following versions are affected:
Release: 605, 606, 616, 617


Vendor contact timeline:
------------------------
2017-07-12: Contacted vendor via encrypted email with vulnerability description
and Responsible Disclosure Policy attached at secure@sap.com
2017-07-13: Vendor confirmed the receipt of the email
2017-07-25: Vendor confirmed the vulnerability
2017-07-31: Contacted vendor to ask for patch release date and versions affected
2017-08-01: Vendor stated they are working on the fix and requested "adequate
time". Link to SAP Responsible Disclosure Policy was provided.
2017-08-01: Discussing release date, requested planned patch release date and
versions affected.
2017-08-02: Vendor stated that the patch cannot be published until 2017-08-31
and requested more time before advisory publication.
2017-08-23: Contacted vendor to request current patch status, planned patch
release date and versions affected.
2017-08-24: Vendor stated that the patch is planned to be published on
2017-09-12.
2017-08-24: Contacted vendor to request versions affected.
2017-08-28: Vendor provided versions affected.
2017-08-29: Defined 2017-09-12 as the actual advisory publication date.
2017-08-30: Vendor confirms advisory publication date.
2017-09-07: Contacted vendor to confirm patch release date and to request number
of fixed release / patch.
2017-09-07: Vendor provided security note number for the patch.
2017-09-12: Public release of advisory.


Solution:
---------
A patched version of SAP E-Recruiting should be installed, as the vendor
has rated this vulnerability with CVSS 6.5 base score.

Please refer to SAP Security Note 2507798 for further information.


Workaround:
-----------
None


Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Berlin - Frankfurt/Main - Montreal - Moscow
Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/contact/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Marc Nimmerrichter / @2017

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close