Pierluigi Paganini November 02, 2016

Experts from ERPScan revealed that a SAP flaw patched in September still impacts more than 900 SAP systems exposed to the Internet.

An information disclosure vulnerability in SAP that was patched in September impacts more than 900 SAP systems that are exposed to the Internet.

According to the expert Sergiu Popa from Quenta Solutions who reported the vulnerability, the flaw could be exploited by a remote attacker to obtain the list of SAP users from the vulnerable system. An attacker can trigger the flaw to obtain users’ data, including usernames, user IDs and emails, all information that could be used to launch spear phishing attacks and power spam campaign.

“The vulnerability allows an external attacker to remotely obtain the list of SAP users from the system by exploiting an information disclosure vulnerability in the following service:”

/webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd/
com.sap.caf.eu.gp.example.timeoff.wd.create.ACreate

“This service is actually an example of application to create a time-off request. This service should not be activated in production systems, however, it’s installed by default and, in reality, few SAP customers disable the component.

The vulnerability allows obtaining usernames, user IDs and even emails if this information was provided by a user. The information related to username and email can be used for a phishing attack by sending a malware to these users.”wrote Alexander Polyakov, founder of ERPScan, in a blog post.

It has been estimated more than 15% of all SAP systems exposed to the Internet are vulnerable to this flaw, according to ERPScan, currently, there are at least 941 vulnerable SAP systems exposed to the Internet.

Other similar flaws were found affecting SAP web service, experts at ERPScan have recently helped to fix two similar issues in other applications.

“To make matters worse, an SAP system has 1000+ of such applications enabled by default. Thus, there is a need for detailed analysis of all exposed web services,” added Polyakov from ERPScan.

ERPScan reported this vulnerability for the first time on July 12, but avoided to disclose the details on it for three months, to comply with SAP’s policy on publicly disclosing information on vulnerabilities.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – SAP systems, hacking)