id: CVE-2020-6207 info: name: SAP Solution Manager 7.2 - Remote Command Execution author: _generic_human_ severity: critical description: SAP Solution Manager (SolMan) running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem). The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents, send HTTP request (SSRF), and execute OS commands on connected SMDAgent. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system. remediation: | Apply the latest security patches provided by SAP to mitigate this vulnerability. reference: - https://launchpad.support.sap.com/#/notes/2890213 - https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305 - https://i.blackhat.com/USA-20/Wednesday/us-20-Artuso-An-Unauthenticated-Journey-To-Root-Pwning-Your-Companys-Enterprise-Software-Servers-wp.pdf - https://github.com/chipik/SAP_EEM_CVE-2020-6207 - https://www.rapid7.com/db/modules/auxiliary/admin/sap/cve_2020_6207_solman_rce/ - https://www.rapid7.com/db/modules/exploit/multi/sap/cve_2020_6207_solman_rs/ - https://nvd.nist.gov/vuln/detail/CVE-2020-6207 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-6207 cwe-id: CWE-306 epss-score: 0.97439 epss-percentile: 0.99944 cpe: cpe:2.3:a:sap:solution_manager:7.20:*:*:*:*:*:*:* metadata: max-request: 1 vendor: sap product: solution_manager tags: cve2020,cve,sap,solman,rce,kev http: - raw: - | POST /EemAdminService/EemAdmin HTTP/1.1 Host: {{Hostname}} SOAPAction: "" Content-Type: text/xml; charset=UTF-8 Connection: close matchers-condition: and matchers: - type: word part: body words: - ":Envelope" - ":Body" - ":getAllAgentInfoResponse" condition: and - type: word part: header words: - "text/xml" - "SAP NetWeaver Application Server" condition: and - type: status status: - 200 # digest: 490a0046304402206f10f6390a1f28d284757ba7222f8e714ac03076c664a8120f972e03a1f21b0e022076e4a6fb68aa6b3cf516332820510096fc1215afa44a1de9d081510ecac38195:922c64590222798bb761d5b6d8e72950