Question Re: SAP RECON Vulnerability - Validation method issue in Technology Q&A

SAP RECON Vulnerability - Validation method issue

Former Member — Mon, 24 Aug 2020 17:36:43 GMT

Hi,

Extracted from the SAP Note #2939665 there are two methods to verify if the vulnerable URL is blocked, by a POST call or a WS Navigator, but using the public python PoC, and after seeing the code myself, it seems that a GET call works too to proof if a server is vulnerable.

Could you confirm this? And if yes, Could you change the details in the SAP Note #2939665?

Thanks in advance.

Regards

Javier

Re: SAP RECON Vulnerability - Validation method issue

cris_hansen — Mon, 24 Aug 2020 17:43:36 GMT

Hello Javier,

If you have the same 404 HTTP error when using the GET method, then you see that the URL is blocked.

About a change in the details in SAP Note 2939665, this should be addressed via Support Incident, under BC-INS-CTC component, owner of the SAP Note.

Related to this topic, you can also read KBA 2948106 - FAQ - for SAP Note 2934135 - [CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard).

Regards,

Cris

Re: SAP RECON Vulnerability - Validation method issue

Former Member — Mon, 24 Aug 2020 22:38:28 GMT

Thanks for the reply.

So it means that "yes" a GET call is also valid to verify the vulnerability. Would you agree?

In addition:

Would the part "?wsdl" call from the URL: https://<host>:<port>/CTCWebService/CTCWebServiceBean?wsdl also indicates that a system is vulnerable?

Would it be a good practice to scan for this vulnerability on all the possible JAVA ports reported by SAP here?

Regards.

Javier

Re: SAP RECON Vulnerability - Validation method issue

cris_hansen — Mon, 24 Aug 2020 22:52:47 GMT

Hi Javier,

The purpose of the GET or POST methods are to have the 404 HTTP error returned. If you get this response, then it means that you have correctly performed the fix from SAP Note 2939665.

Regards,

Cris