TR18: I forgot Your password

## Overview

Noel Sanchez and Marta Morena present research on critical vulnerabilities discovered in SAP HANA's User Self-Service (USS) application, the default platform for password recovery and account creation. USS is a web application built on SAP HANA's development platform using XSJS (server-side JavaScript) that authenticates to the database using a privileged technical user with account creation and password modification capabilities.

## Key Topics

### Common Password Recovery Patterns The speakers explain why password recovery mechanisms are high-value attack targets: nearly every modern system implements them, no secure default solution exists, the code is often developed by junior developers, and recovery functions perform critical unauthenticated actions. Common implementations include plain-text storage, random password resets, email-based reset tokens, and security questions.

### Vulnerabilities Discovered

**1. User Enumeration** - Attackers can enumerate valid usernames through differing error messages during password reset requests.

**2. Email Header Injection** - The HTTP Host header used in email templates is not sanitized and controlled by attackers, enabling phishing attacks against administrators.

**3. Blacklist Bypass** - IP blacklist checks against the X-Forwarded-For header can be bypassed by appending approximately 1,067 garbage characters, filling the array and preventing address matching.

**4. Token-Security Answer Confusion** - The most critical vulnerability stems from storing both password reset tokens and security answers in the same database table without differentiation. Security answers are not validated for format, allowing attackers to inject JSON payloads. The key format (USERNAME.security_underscore_answer) is predictable.

**5. SQL Injection via JSON Injection** - Usernames are concatenated into SQL queries without prepared statements. Although usernames are validated at creation, the application retrieves usernames from database JSON values. Attackers can inject usernames containing SQL comments and special characters through the security answer mechanism to execute arbitrary SQL, including activating the deactivated system user.

## Technical Attack Chain

The researchers demonstrate a multi-step account takeover exploiting token-security answer confusion and SQL injection:

1. Register a test account and intercept the validation request 2. Inject a JSON payload into the security answer field containing SQL injection code that activates the system user via ALTER USER system ACTIVATE statement 3. Request a new password reset token 4. Inject another JSON payload with the target victim's username to hijack their account 5. Use the hijacked account token to set a new password for any user, including the system user 6. Login as the system user

The system user is SAP HANA's most privileged account—created by default, capable of granting itself any roles, reading/modifying all database records, and modifying application source code. Obtaining system user access enables complete platform compromise.

## Takeaways

The researchers conclude that password recovery mechanism complexity is the root cause, with many implementations combining multiple methods insecurely. Recovery features should be treated with the same security rigor as authentication mechanisms. The primary remediation is using prepared statements instead of query concatenation. SAP released security notes addressing these vulnerabilities; affected versions span SPS 9 through SPS 12. Mitigations include applying patches, disabling USS if unused, and restricting access to trusted hosts.