vendor:
NetWeaver
by:
Michael Jordon, juan vazquez
N/A
CVSS
N/A
Command Injection
78
CWE
Product Name: NetWeaver
Affected Version From: SAP NetWeaver 7.02 SP6
Affected Version To: SAP NetWeaver 7.02 SP6
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2012
SAP NetWeaver HostControl Command Injection
This module exploits a command injection vulnerability in the SAPHostControl Service, by sending a specially crafted SOAP request to the management console. In order to deal with the spaces and length limitations, a WebDAV service is created to run an arbitrary payload when accessed as a UNC path. Because of this, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3, but disabled by default on Windows 2003 SP2.
Mitigation:
Disable WebClient service (WebDAV Mini-Redirector) on Windows 2003 SP2.