Back to list
[Onapsis Security Advisory 2014-021] SAP HANA XS Missing encryption in form-based authentication
Jul 29 2014 02:53PM
Onapsis Research Labs (research onapsis com)
-----BEGIN PGP SIGNED MESSAGE-----
Onapsis Security Advisory 2014-021: SAP HANA XS Missing encryption in
This advisory can be downloaded in PDF format from
By downloading this advisory from the Onapsis Resource Center, you will
gain access to beforehand information on upcoming advisories,
presentations and new research projects from the Onapsis Research Labs,
as well as exclusive access to special promotions for upcoming trainings
1. Impact on Business
SAP HANA XS does not enforce any encryption in the form based
could allow an anonymous user to get information such as valid
network traffic, gaining access into the system.
Risk Level: Low
2. Advisory Information
- - Public Release Date: 2014-07-29
- - Subscriber Notification Date: 2014-07-29
- - Last Revised: 2014-07-25
- - Security Advisory ID: ONAPSIS-2014-021
- - Onapsis SVS ID: ONAPSIS-0094
- - Researcher: Sergio Abraham, Manuel Muradas
- - Initial Base CVSS v2: 2.9 (AV:A/AC:M/AU:N/C:P/I:N/A:N)
3. Vulnerability Information
- - Vendor: SAP
- - Affected Components:
- - SAP HANA Extended Application Services (Check SAP Note 1963932 for
detailed information on affected releases)
- - Vulnerability Class: Cleartext Transmission of Sensitive Information
- - Remotely Exploitable: Yes
- - Locally Exploitable: No
- - Authentication Required: No
- - Detection Module available in Onapsis X1: Yes
- - Original Advisory:
4. Affected Components Description
SAP HANA Extended Application Services (XS) is an application server,
web server and
development environment for web applications within the SAP HANA System.
SAP HANA XS
is fully integrated with the SAP HANA Database.
5. Vulnerability Details
SAP HANA Extend Application Services (XS) based applications can be set
to be ?form based
authentication? access using SSL. When this configuration is set, the
mechanism does not properly enforce the required level of encryption.
Technical details about this issue are not disclosed at this moment with
the purpose of
providing enough time to affected customers to patch their systems and
protect against the
exploitation of the described vulnerability.
SAP has released SAP Note 1963932 which provides patched versions of the
The patches can be downloaded from
Onapsis strongly recommends SAP customers to download the related
security fixes and
apply them to the affected components in order to reduce business risks.
7. Report Timeline
2013-10-29: Onapsis provides vulnerability information to SAP AG.
2013-10-30: SAP confirms having the information of vulnerability.
2014-03-11: SAP releases security patches.
2014-07-29: Onapsis notifies availability of security advisory.
About Onapsis, Inc.
Onapsis provides innovative security software solutions to protect ERP
cyber-attacks. Through unmatched ERP security, compliance and continuous
products, Onapsis secures the business-critical infrastructure of its
global customers against
espionage, sabotage and financial fraud threats.
Onapsis X1, the company's flagship product, is the industry's first
comprehensive solution for
the automated security assessment of SAP platforms. Being the first and
solution of its kind, Onapsis X1 allows customers to perform automated
Assessments, Security & Compliance Audits and Penetration Tests over
their entire SAP
Onapsis is backed by the Onapsis Research Labs, a world-renowned team of
SAP & ERP
security experts who are continuously invited to lecture at the leading
conferences, such as RSA and BlackHat, and featured by mainstream media
such as CNN,
Reuters, IDG and New York Times.
For further information about our solutions, please contact us at
info (at) onapsis (dot) com [email concealed] and visit
our website at www.onapsis.com.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Onapsis Research Team
-----END PGP SIGNATURE-----
This list is sponsored by: Information Assurance Certification Review Board
Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
[ reply ]
Copyright 2010, SecurityFocus