module
SAP Solution Manager remote unauthorized OS commands execution
| Disclosed |
|---|
| Oct 3, 2020 |
Disclosed
Oct 3, 2020
Description
This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem) of
SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication
checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get information about connected SMDAgents,
send HTTP request (SSRF) and execute OS command on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8.
Successful exploitation will allow unauthenticated remote attackers to get reverse shell from connected to the SolMan
agent as the user under which it runs SMDAgent service, usually daaadm.
SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication
checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get information about connected SMDAgents,
send HTTP request (SSRF) and execute OS command on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8.
Successful exploitation will allow unauthenticated remote attackers to get reverse shell from connected to the SolMan
agent as the user under which it runs SMDAgent service, usually daaadm.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.