Notas de Seguridad SAP, Marzo 2021

Inprosec a través de sus servicios, como el SAP Security Assessment, ayuda a sus clientes a mejorar los niveles de seguridad de sus sistemas SAP.

Notas Marzo 2021

Resumen y highlights del Mes

El número total de notas/parches ha disminuido con respecto al último mes. A pesar de esta bajada en el número de notas totales, el número de Hot News aumenta, siendo 3 las que encontrábamos el mes pasado con respecto a las 4 existentes en Marzo. Por otro lado, cabe destacar, que disminuye el número de notas de criticidad alta pasando de 2 a 1 en este mes. Como siempre dejaremos las notas medias y bajas sin revisar en este mes, pero daremos detalle de un total de 5 notas (todas las que tengan un CVSS de 7 o mayor).

Tenemos un total de 18 notas para todo el mes, 2 menos que el pasado Febrero (13 del patch Tuesday, 9 nuevas y 4 actualizaciones, siendo el mismo número de notas que el pasado mes).

Tenemos 2 notas críticas (Hot News) nuevas, siendo el total de 4 en este mes que destacan por su alto CVVS, una de ellas la actualización recurrente para el SAP Business Client con Chromium . Además revisaremos en detalle la única nota alta de este mes (con un CVSS mayor que 7) que además es una nota nueva.

• Las notas más críticas del mes (con CVSS 10) son dos actualizaciones. Una de Missing Authentication Check que afecta a SAP Solution Manager y otra la habitual “Browser Control Google Chromium Delivered with SAP Business Client”.
• Las siguientes en criticidad (con CVSS 9.9 y 9.6) es una de Code Injection Vulnerability que afecta a SAP MII y la otra una de Missing Authorization Check que afecta a SAP NetWeaver AS JAVA (MigrationService).
• A partir de ahí, localizamos una única nota de criticidad alta (high priority) con un CVSS de 7.7 siendo una nota nueva de posible omisión de autentificación que afecta a los escenarios de SAP HANA LDAP.
• Este mes los tipos más predominantes son “Missing Authorization Check” (5/18 y 4/13 en patch day) y “Reverse Tabnabbing” (4/20 y 1/13 en patch day).

En la gráfica (post Marzo 2021 de SAP) podemos ver la clasificación de las notas de Marzo además de la evolución y clasificación de los últimos 5 meses anteriores (solo las notas del Sec. Tuesday / Patch Day – by SAP):

Detalle completo

El detalle completo de las notas más relevantes es el siguiente (en inglés):

1. Update – Missing Authentication Check in SAP Solution Manager (User-Experience Monitoring) (2890213): It contains a minor textual update to the possible symptoms of the vulnerability. The note was originally released in March 2020. The last important update of this note was published in November 2020 providing support for an additional support package level of the affected application. CVSS v3 Base Score: 10 / 10 (CVE-2020-6207).
2. Update – Security updates for the browser control Google Chromium delivered with SAP Business Client (2622660): This note now includes Chromium version 88.0.4324.150. Compared to the last supported Chromium version (87.0.4280.66), this new version fixes 67 security issues in total, two of them rated by Google as critical (CVE-2021-21117 and CVE-2021-21142). The highest CVSS score of all newly fixed vulnerabilities is 9.6.CVSS v3 Base Score: 10 / 10.
3. Code Injection Vulnerability in SAP MII (3022622): It patches a very critical code injection vulnerability in SAP Manufacturing Intelligence and Integrations (SAP MII). SAP MII or xMII (its previous name) is an SAP NetWeaver AS Java based platform that enables real-time production monitoring and provides extensive data analysis tools. It functions as a data hub between SAP ERP and operational applications such as manufacturing execution systems (MES). The software collects data from production machinery, delivering real-time insights into its performance and efficiency. An integral part of SAP MII is the Self-Service Composition Environment (SSCE) that can be used to design dashboards by simple drag and drop. The SSCE allows users to save a dashboard as a JSP file. An attacker can intercept a request to the server, inject malicious JSP code in the request and forward it to the server. When such an infected dashboard is opened in production by a user having a minimum of authorizations, the malicious content gets executed, leading to remote code execution in the server. Some possible actions are: Access to the SAP databases and read/modify/erase any record in any table; Use these servers to pivot to other servers; Place malware to later infect end users; Modify network configurations and potentially affect internal networks. CVSS v3 Base Score: 9.9 / 10 (CVE-2021-21480).
4. Missing Authorization Check in SAP NetWeaver AS JAVA (Migration Service) (3022422): It patches a missing authorization check in the Migration Service of SAP NetWeaver AS Java. This service is used internally by the migration framework for migrating applications between major releases of the J2EE Engine. The missing authorization check might allow an unauthorized attacker to gain administrative privileges. This could result in complete compromise of the system’s confidentiality, integrity and availability. As applying the patch that is attached to the note requires a system restart, SAP also provides a temporary workaround that can be deployed online. SAP refers to the workaround as “a notable improvement,” but recommends applying the final patch in parallel as soon as possible. While the workaround just blocks the accessibility to the Migration Service, the final patch adds the missing authorization check to it. CVSS v3 Base Score: 9.6 / 10 (CVE-2021-21481).
5. Possible authentication bypass in SAP HANA LDAP scenarios (3017378): It fixes the possibility of an authentication bypass in SAP HANA LDAP scenarios. The authentication bypass is possible if the following conditions apply: The LDAP directory server is configured to enable unauthenticated bind; The SAP HANA database is configured to allow access based on LDAP authentication; SAP HANA is configured to automatically create users based on LDAP authentication. Following the assigned CVSS vector, the vulnerability has a high impact on the system’s confidentiality and integrity. CVSS v3 Base Score: 7.7 / 10 (CVE-2021-21484).

Enlaces de referencia

Enlaces de referencia del CERT del INCIBE en relación a la publicación de las notas para el mes de Marzo:

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-sap-marzo-2021

Otras referencias, en inglés de SAP y Onapsis (Marzo):

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107

https://onapsis.com/blog/sap-security-notes-march-2021

Recursos afectados

• SAP 3D Visual Enterprise Viewer, versión 9;
• SAP Business Client, versión 6.5;
• SAP BusinessObjects Business Intelligence Platform (Web Services), versiones 410, 420 y 430;
• SAP Enterprise Financial Services (Bank Customer Accounts), versiones 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618 y 800;
• SAP ERP, versiones 600, 602, 603, 604, 605, 606, 616, 617 y 618;
• SAP HANA, versión 2.0;
• SAP Manufacturing Integration e Intelligence, versiones 15.1, 15.2, 15.3 y 15.4;
• SAP NetWeaver:
  • Application Server Java (Applications based on Web Dynpro Java), versiones 7.00, 7.10, 7.11, 7.20, 7.30, 731, 7.40 y 7.50;
  • AS JAVA (MigrationService), versiones 7.10, 7.11, 7.30, 7.31, 7.40 y 7.50;
  • Knowledge Management, versiones 7.01, 7.02, 7.30,7.31, 7.40 y 7.50;

• SAP Payment Engine, versión 500;
• SAP S/4 HANA, versiones 100, 101, 102, 103 y 104;
• SAP Solution Manager (User Experience Monitoring), versión 7.2;