[Onapsis Security Advisory 2014-021] SAP HANA XS Missing encryption in form-based authentication

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Onapsis Security Advisory 2014-021: SAP HANA XS Missing encryption in
form-based authentication

This advisory can be downloaded in PDF format from
http://www.onapsis.com/.

By downloading this advisory from the Onapsis Resource Center, you will
gain access to beforehand information on upcoming advisories,
presentations and new research projects from the Onapsis Research Labs,
as well as exclusive access to special promotions for upcoming trainings
and conferences.

1. Impact on Business

SAP HANA XS does not enforce any encryption in the form based
authentication. It
could allow an anonymous user to get information such as valid
credentials from
network traffic, gaining access into the system.

Risk Level: Low

2. Advisory Information

• • Public Release Date: 2014-07-29
• • Subscriber Notification Date: 2014-07-29
• • Last Revised: 2014-07-25
• • Security Advisory ID: ONAPSIS-2014-021
• • Onapsis SVS ID: ONAPSIS-0094
• • Researcher: Sergio Abraham, Manuel Muradas
• • Initial Base CVSS v2: 2.9 (AV:A/AC:M/AU:N/C:P/I:N/A:N)

3. Vulnerability Information

• • Vendor: SAP
• • Affected Components:
• • SAP HANA Extended Application Services (Check SAP Note 1963932 for
    detailed information on affected releases)
• • Vulnerability Class: Cleartext Transmission of Sensitive Information
    (CWE-319)
• • Remotely Exploitable: Yes
• • Locally Exploitable: No
• • Authentication Required: No
• • Detection Module available in Onapsis X1: Yes
• • Original Advisory:
    http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-021

4. Affected Components Description

SAP HANA Extended Application Services (XS) is an application server,
web server and
development environment for web applications within the SAP HANA System.
SAP HANA XS
is fully integrated with the SAP HANA Database.

5. Vulnerability Details

SAP HANA Extend Application Services (XS) based applications can be set
to be ?form based
authentication? access using SSL. When this configuration is set, the
authentication
mechanism does not properly enforce the required level of encryption.

Technical details about this issue are not disclosed at this moment with
the purpose of
providing enough time to affected customers to patch their systems and
protect against the
exploitation of the described vulnerability.

6. Solution

SAP has released SAP Note 1963932 which provides patched versions of the
affected
components.
The patches can be downloaded from
https://service.sap.com/sap/support/notes/1963932.
Onapsis strongly recommends SAP customers to download the related
security fixes and
apply them to the affected components in order to reduce business risks.

7. Report Timeline

2013-10-29: Onapsis provides vulnerability information to SAP AG.
2013-10-30: SAP confirms having the information of vulnerability.
2014-03-11: SAP releases security patches.
2014-07-29: Onapsis notifies availability of security advisory.

About Onapsis, Inc.
Onapsis provides innovative security software solutions to protect ERP
systems from
cyber-attacks. Through unmatched ERP security, compliance and continuous
monitoring
products, Onapsis secures the business-critical infrastructure of its
global customers against
espionage, sabotage and financial fraud threats.
Onapsis X1, the company's flagship product, is the industry's first
comprehensive solution for
the automated security assessment of SAP platforms. Being the first and
only SAP-certified
solution of its kind, Onapsis X1 allows customers to perform automated
Vulnerability
Assessments, Security & Compliance Audits and Penetration Tests over
their entire SAP
platform.
Onapsis is backed by the Onapsis Research Labs, a world-renowned team of
SAP & ERP
security experts who are continuously invited to lecture at the leading
IT security
conferences, such as RSA and BlackHat, and featured by mainstream media
such as CNN,
Reuters, IDG and New York Times.
For further information about our solutions, please contact us at
[email protected] and visit
our website at www.onapsis.com.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Onapsis Research Team

iEYEARECAAYFAlPXtXsACgkQz3i6WNVBcDWe+QCcCLTCuJTlLrxGuWAx3BeNPTIC
Ev0AoIhKG5U6sClUI07O5jyaHisTJo9L
=4t7L
-----END PGP SIGNATURE-----