Pre-auth remote commands execution in SAP MaxDB 7.6.03.07

2008.01.12
Risk: High
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

####################################################################### Luigi Auriemma Application: SAP MaxDB https://www.sdn.sap.com/irj/sdn/maxdb http://www.sap.com Versions: <= 7.6.03 build 007 Platforms: Windows, Linux and Solaris Bug: pre-auth remote commands execution Exploitation: remote Date: 09 Jan 2008 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== SAP MaxDB is a commercial and widely known and used database. ####################################################################### ====== 2) Bug ====== The MaxDB server executes "cons.exe DATABASE COMMAND" through system() when some special commands are called by the user. Some of these special commands are "show" and "exec_sdbinfo" and this last one is just one of the small amount of commands which can be executed by the unauthenticated users before logging in. The usage of system() for executing the cons program allows an external unauthenticated attacker to execute any command he wants on the target SAP MaxDB server simply passing the "&&" or other patterns for the execution of multiple commands in the shell. So it's just enough to use the following SAP command to see the content of C: on Windows (the bug is naturally exploitable on any other platform supported by the server): exec_sdbinfo && echo dir c:\ | cmd.exe Then the rest and all the other possibilities of exploiting this vulnerability are in the fantasy of the attacker... ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/sapone.zip ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top