Document Title:
===============
HITB2011KUL - SAPocalypse Now, CrushingSAPs J2EE


References:
===========
View: 		http://www.youtube.com/watch?v=bu6JnwqhRV0



Release Date:
=============
2012-03-05


Vulnerability Laboratory ID (VL-ID):
====================================
469


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Event


Severity Level:
===============
Medium


Technical Details & Description:
================================
Having had great success with the first part of our research “A crushing blow at the heart of 
SAP’s J2EE Engine” this is a continuation in this series of presentations and will look deeper 
at new web-based attacks and post exploitations on SAP’s J2EE applications.

We will explain the architecture of SAP’s J2EE engine and give a complete tour into its internals. 
Thereafter, we will show a number of previously unknown architecture and program vulnerabilities 
from auth bypasses, smbrelays, internal scans, XML/SOAP attacks to insecure encryption algorithms 
and cross-system vulnerabilities in the J2EE platform. Finally a chained attack which use multiple 
logic vulnerabilities that gives full control over SAP’s J2EE Engine will be demoed. A free tool 
will also be presented to automatically scan custom applications against this attack.

Will this attack concept lead to a new worm? Who knows, but be prepared for SAPocalypsis NOW!


Credits & Authors:
==================
Alexander Polyakov is the CTO at ERPScan company. Head of DSecrG research center (department of ERPScan). 
His expertise covers enterprise business-critical software like ERP, CRM, SRM, RDBMS, SCADA, banking and 
processing software. He found a lot of vulnerabilities in the products of such vendors as SAP and Oracle, 
and has made a lot of projects focused on special applications security in oil and gas, retail and banking 
sphere. He is the author of a book titled “Oracle Security from the Eye of the Auditor:Attack and Defense 
(in Russian).” He is also lead a OWASP-EAS, architect of ERPSCAN Security Scanner for SAP (http://erpscan.com)
, one of the contributors to Oracle with Metasploit project. Speaker at HITB (EU/ASIA), BlackHat, Source, 
DeepSec, Confidence, Troopers and many Russian conferences.

Dimitry Chastuhin is a student of St. Petersburg State Polytechnic University, computer science department, 
he works upon SAP security, particularly upon Web applications and JAVA systems. He has official acknowledgements 
from SAP for the vulnerabilities found. Dmitriy is also a WEB 2.0 and social network security geek who found 
several critical bugs in Vkontakte (vk.com) and Yandex.ru, the Russian largest social networks and search engines. 
He is a contributor to the OWASP-EAS project.


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    admin@vulnerability-lab.com 	- support@vulnerability-lab.com 	       - research@vulnerability-lab.com
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory