# MA-606.052016: MyCERT Alert - Exploitation of SAP Business Applications

**Date:** 12 May 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-606.052016  
**Advisory ID:** MA-606.052016

---

####
**1.0 Introduction**
SAP is INTEGRATED business software to process all functionalities of an organization in order to obtain a UNIFIED solution. SAP is stands for System, Application, and Products in data processing. It’s provided end-to-end solutions for financial, manufacturing, logistics, distribution, inventories, and etc.
Security researchers from Onapsis discovered indicators of exploitation against of at least 36 organizations’ that is running on SAP business applications. SAP systems which is running outdated or misconfigured software are exposed to increase risks of malicious attacks. The Invoker Servlet vulnerability will affects business applications that running on SAP Java platforms.
Users and administrators are encouraged to implement SAP Security Note 1445998, available at Section 4.1 of this document and apply the necessary action
**2.0 Impact**
The exploitation of this vulnerability gives remote unauthenticated attackers full access to the affected SAP platforms, providing them with complete control of the business information and processes run by them, as well as potentially further access to connected SAP and non-SAP systems.
**3.0 Affected Products**
The following list includes some of the SAP business solutions and technical components that may be affected if their underlying SAP Java platforms have not been properly secured:
- SAP Enterprise Resource Planning (ERP)
- SAP Product Life-cycle Management (PLM)
- SAP Customer Relationship Management (CRM)
- SAP Supply Chain Management (SCM)
- SAP Supplier Relationship Management (SRM)
- SAP Enterprise Portal (EP)
- SAP Process Integration (PI)
- SAP Exchange Infrastructure (XI)
- SAP Solution Manager (SolMan)
- SAP NetWeaver Business Warehouse (BW)
- SAP Business Intelligence (BI)
- SAP NetWeaver Mobile Infrastructure (MI)
- SAP NetWeaver Development Infrastructure (NWDI)
- SAP Central Process Scheduling (CPS)
- SAP NetWeaver Composition Environment (CE)
- SAP NetWeaver Enterprise Search
- SAP NetWeaver Identity Management (IdM)
- SAP Governance, Risk & Control 5.x (GRC)
**4.0 Recommendation**
MyCERT highly recommends users of these applications to implement the SAP Security Note 1445998 and disable the Invoker Servlet.
> 4.1 Security Note 1445998
> SAP Security Notes contain SAP's expert advice regarding important action items and patches to ensure the security of user systems.
> <https://support.sap.com/securitynotes>
>
> 4.2 It is highly recommended for users and system administrators to ensure the following steps are in place:
>
> - Scan systems for all known vulnerabilities, such as missing security patches and dangerous system configurations.
> - Identify and analyze the security settings of SAP interfaces between systems and applications to understand risks posed by these trust relationships.
> - Analyze systems for malicious or excessive user authorizations.
> - Monitor systems for indicators of compromise resulting from the exploitation of vulnerabilities.
> - Monitor systems for suspicious user behavior, including both privileged and non-privileged users.
> - Apply threat intelligence on new vulnerabilities to improve the security posture against advanced targeted attacks.
> - Define comprehensive security baselines for systems and continuously monitor for compliance violations and remediate detected deviations
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#07647e6562753e3e3e47647e65627574626472756e737e296a7e) or [[email protected]](/cdn-cgi/l/email-protection#fe93879d9b8c8abe93879d9b8c8ad0918c99d09387) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Exploitation of SAP Business Applications: <https://www.us-cert.gov/ncas/alerts/TA16-132A>
- FAQ : About CERT Warning SAP System: <https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications>
- SAP vulnerability exploited to compromise enterprises worldwide: <https://www.helpnetsecurity.com/2016/05/11/sap-vulnerability-exploited/>
- DSAG & ASUG & SAUG & ES: Security Notes: <https://support.sap.com/dam/library/SAP%20Support%20Portal/support-programs-services/support-services/security-optimization-service/media/SAP_Security_Notes_Webinar.pdf>