TR18: SAP BUGS: The Phantom Security

## Overview

Vihan and Vladimir from Earpiece present critical security vulnerabilities discovered in SAP systems, demonstrating an exploitation chain from directory traversal to remote code execution through Redwood and CRM components.

## Key Topics

**SAP Security Context**: SAP releases approximately 300 security patches annually. In 2017 alone, 313 critical vulnerabilities were patched. The SAP Java stack comprises thousands of applications deployed across enterprise systems.

**Redwood Component Directory Traversal (2016)**: The Redwood scheduler servlet contains a directory traversal vulnerability in the UIUtil JavaScript servlet. By manipulating the "util" parameter with traversal sequences (../), attackers can read arbitrary files without authentication. This allows access to critical secure storage files containing administrator credentials and database connection strings.

**Secure Storage Decryption**: SAP servers store sensitive data in encrypted files (sexstore.properties and sexstore.key). The speakers developed a "sexstore decrypter" tool exploiting the encryption implementation. The encryption uses Triple DES in CBC mode with a hard-coded key found in Java source code. By decrypting these files, attackers obtain plain-text administrator passwords and database credentials.

**CRM Component RCE Chain**: A second directory traversal vulnerability in SAP CRM service enables: (1) changing log file location and extension, (2) redirecting logs to application directories, (3) modifying extension to .JSP, (4) writing JSP shellcode via malformed requests, (5) executing arbitrary Java code when SAP parses the JSP files. The speakers automated this via Python scripts sending specially crafted requests containing JSP code within error messages.

**Practical Impact**: Approximately 500 publicly accessible SAP servers with Redwood component were discovered on the internet. The combined vulnerabilities enable unauthenticated attackers to gain full administrative access and execute arbitrary commands.

**Remediation**: Install SAP security patches for Redwood and CRM, apply firewall rules restricting CRM connections, and install additional security notes from SAP/NIST.

The speakers demonstrated live exploitation showing file reading, credential decryption, and command execution on compromised SAP systems.