The May 2019 SAP Security Notes update Note 1408081 in response to 10KBLAZE exploits against the gateway server, and add Note 2756453 (S/4HANA cross-site scripting) and Note 2784307 (SAP Identity Management REST Interface). Maintain access control lists for the message server as well as the gateway.
Executive Summary
Note 1408081 was updated in May in response to the recent 10KBLAZE exploits targeting vulnerabilities in the gateway server. It includes revised instructions for maintaining access control lists in the gateway security files reg_info and sec_info for different kernel versions, restricting registrations and starts to the same system or SID cluster with the options ‘local’ and ‘internal’. The updates do not mention that attackers who register as internal servers with the message server could bypass these mechanisms, so access control lists for the message server must also be maintained. Note 2756453 removes a high-risk cross-site scripting vulnerability in S/4HANA, and Note 2784307 addresses a high-risk REST Interface vulnerability in SAP Identity Management that could be exploited to escalate privileges.
Key Takeaways
- Note 1408081 was updated in May in response to the 10KBLAZE exploits targeting the gateway server.
- Restrict registrations and program starts to the same system or SID cluster using the options ‘local’ and ‘internal’ in reg_info and sec_info.
- Attackers that register as internal servers with the message server could bypass the recommended entries, so maintain message server access control lists.
- Use a separate port for internal message server communications, reject external monitor commands, encrypt kernel component communications and set the gw/reg_no_con_info bit mask to 255.
- Note 2756453 fixes a high-risk XSS vulnerability in S/4HANA; Note 2784307 fixes a high-risk privilege escalation risk in the SAP Identity Management REST Interface.
What changed in SAP Note 1408081 after the 10KBLAZE exploits?
Note 1408081 was updated in May in response to the recent 10KBLAZE exploits targeting vulnerabilities in the gateway server. The note includes revised instructions for maintaining access control lists in the gateway security files reg_info and sec_info for different kernel versions.
The access control lists should be configured to control external server registrations and program starts. The note recommends restricting registrations and starts to within the same system or SID cluster using the options ‘local’ and ‘internal’.
Why must message server access control lists be maintained?
The updates do not mention the risk that the security mechanisms applied by the recommended entries could be bypassed by attackers that register as internal servers with the message server. Therefore, it is critical to maintain access control lists for the message server to support the secure configuration of the gateway server.
What additional security helps against 10KBLAZE exploits?
A separate port should be configured for internal message server communications, external monitor commands should be rejected, communications between kernel components should be encrypted, and the bit mask value for the profile parameter gw/reg_no_con_info should be set to a value of 255.
What do Notes 2756453 and 2784307 cover?
Note 2756453 provides manual instructions and automated corrections for removing a high-risk cross-site scripting vulnerability in S/4HANA.
Note 2784307 deals with another high-risk vulnerability in the REST Interface that could be exploited to escalate privileges in SAP Identity Management.
Frequently Asked Questions
Why was SAP Note 1408081 updated in May 2019?
It was updated in response to the recent 10KBLAZE exploits targeting vulnerabilities in the gateway server. The note includes revised instructions for maintaining access control lists in the gateway security files reg_info and sec_info for different kernel versions.
What is the risk the Note 1408081 update does not mention?
Attackers that register as internal servers with the message server could bypass the security mechanisms applied by the recommended entries. It is therefore critical to maintain access control lists for the message server.
What additional protections help against 10KBLAZE exploits?
Configure a separate port for internal message server communications, reject external monitor commands, encrypt communications between kernel components, and set the bit mask value for the profile parameter gw/reg_no_con_info to 255.
What do Notes 2756453 and 2784307 address?
Note 2756453 provides manual instructions and automated corrections for removing a high-risk cross-site scripting vulnerability in S/4HANA. Note 2784307 deals with a high-risk vulnerability in the REST Interface that could be exploited to escalate privileges in SAP Identity Management.