# MA-721.052019: MyCERT Alert - 10KBLAZE Exploits on SAP Production System

**Date:** 06 May 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-721.052019  
**Advisory ID:** MA-721.052019

---

**1.0 Introduction**
Recently, MyCERT received information from valid resources about exploits against SAP systems. It happened when Gateway and SAP Message Server in SAP environment that applies access control list (ACL) mechanism in order to identify the IP address that allowed to register application servers. Hence, a wrongly config ACL are risk at being attacked by using public 10KBLAZE exploits, it will allow any host with network access to the Message Server to register an application server. SAP is a well-known for Enterprise Resource Planning (ERP) and data management programs which allow businesses to track customer and business interaction.
**2.0 Impacts**
The vulnerable SAP System could be remotely exploited by attacker by gaining access to their network hosting and take full control which could then full compromised SAP platform, allowing attackers to extract information, remove all the data, or completely take down the system.
**3.0 Affected Product**
- All outdated SAP NetWeaver Application Server (AS)
- SAP Business Suite
- SAP Enterprise Resources Planning (ERP)
- SAP Customer Relationship Management (CRM)
- SAP S/4HANA
- SAP Solution Manager
- SAP GRC Process and Access Contol
- SAP Process Integration/Exchange Infrastructure (PI/XI)
- SAP Solution Manager
- SAP Supply Chain Management (SCM)
- SAP Supplier Relationship Management (SRM)
**4.0 Recommendations**
All affected organizations may refer to SAP Security Notes (SAP login required):
- SAP Security Note #821875: 'Security Settings in the Message Server' from 2005 details Message Server ACL proper configuration
- SAP Security Note #1408081: 'Basic Settings for Reg\_info and Sec\_info' from 2009 explains SAP Gateway ACL proper configuration
- SAP Security Note #1421005: Enforces SAP Security Note #821875
In this year, MyCERT had released several Alerts and Advisories on current threats and vulnerabilities. System Administrators and Internet Users must be aware of these threats and vulnerabilities by applying necessary patches and updates.
The Alerts and Advisories are available at:
<https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5&year=2019&ctype=&keyword=>
For incident reporting and other enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](cyber999@cybersecurity.my) or [[email protected]](mycert@mycert.org.my)
Phone: 1-300-88-2999(monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS:CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: <IOS Users> or <Andriod Users>
**5.0 References**
• <https://www.us-cert.gov/ncas/alerts/AA19-122A>
• <https://securityaffairs.co/wordpress/84870/hacking/10kblaze-sap-exploits.html>
• <https://www.bleepingcomputer.com/news/security/public-10kblaze-exploits-may-impact-90-percent-of-sap-production-systems/>