There Is No Place To Run: Assessing SAP Focused Run Security

### Overview This presentation examines the security posture of SAP Focused Run, a technical administration system designed to monitor and manage large-scale SAP environments. Following prior research into SAP Solution Manager—which revealed significant vulnerabilities enabling lateral movement across managed systems—the speaker investigated SAP Focused Run to see if similar lateral expansion risks existed. While the direct attack surface of the Focused Run central server was considerably hardened and lacked legacy Java or RFC stacks, an analysis of the management architecture revealed that client-side agent deployments dramatically expand the overall attack surface across the entire landscape.

### Key Topics - **Role of Technical Management Systems**: Comparison between legacy platforms like SAP Solution Manager and modern architectures like SAP Focused Run, which centralize administrative control across diverse enterprise landscapes. - **Agent Architecture and Credential Handling**: Deployment and communication flow of the SAP Simple Diagnostics Agent (SDA) alongside SAP Host Control, including configuration file storage and key management. - **Attack Surface Expansion**: How installing technical agents on managed nodes connects satellite system compromises directly back to high-privilege administrative access on the central server. - **Landscape Vulnerabilities**: Specific remote vulnerabilities in connected SAP NetWeaver Java and portal systems that enable attackers to gain local access and pivot through agent infrastructure.

### Technical Details - **Agent Configuration & Decryption**: The SAP Simple Diagnostics Agent is located under `/usr/sap/hostctrl/` and relies on SAP Host Control (listening on ports 1128 and 1129) to forward requests locally to the agent on port 3005. Analysis of the agent's property files (such as `cleartext.properties` and `encrypted.properties`) revealed configuration details, target connection info, and encrypted credentials protected via PBKDF2 and DES/AES schemes. The master password required to decrypt these credentials resides in a protected file restricted to administrative users (such as `sapadm`). - **Unauthenticated Agent API Access**: The agent listening on `localhost:3005` failed to validate authorization headers passed from the Host Control proxy. Any user capable of issuing requests locally to port 3005 could query the agent with `sapadm` privileges, modify whitelists, read arbitrary files (including the master password file), download the zipped configuration, and decrypt stored credentials to authenticate back to the central SAP Focused Run server. - **Pivot Vulnerabilities in Connected Systems**: Multiple vulnerabilities were highlighted that allow attackers to gain the required local access to execute agent-based pivoting: 1. *Missing Authentication in Configuration Wizard / CTC Services*: Allowed execution of configuration tasks via unauthenticated web requests, creating administrative users. 2. *Java Deserialization in Monitoring Component (VIM/Wily)*: A pre-authentication Java deserialization flaw in session cookie processing allowed unauthenticated OS command execution. 3. *Unauthenticated Cluster Message Communication*: Communication on internal Java cluster communication ports allowed unauthenticated interaction with cluster methods to forge SSO assertion cookies. 4. *XSLT / Style Sheet Injection in SAP Enterprise Portal*: Low-privileged or newly registered guest users could upload custom style sheets and exploit transformation configurations to inject Java code and achieve OS command execution.

### Takeaways Securing an SAP landscape cannot be done in isolation by focusing solely on business-critical production databases. Technical and administration systems like SAP Focused Run and their auxiliary agents inherently possess elevated privileges across the environment. If peripheral or low-importance systems are compromised via web vulnerabilities, attackers can extract local agent secrets to pivot and achieve compromise of central management systems. Comprehensive security requires applying vendor security patches promptly, enforcing strict local firewalling on internal communication ports, disabling unneeded services and transformation configurations, and securing administrative systems globally.