The July 2020 SAP Security Notes address three high-priority vulnerabilities, most notably the critical RECON vulnerability in NetWeaver Application Server Java (AS Java). These patches resolve missing authentication flaws, information disclosure risks, and configuration vulnerabilities to protect SAP systems and connected environments from unauthorized code execution and data exposure.
Executive Summary
The July 2020 SAP security update cycle focuses on securing NetWeaver Application Server Java (AS Java) and AS ABAP environments. The most significant threat addressed is the RECON vulnerability, which exploits a missing authentication flaw in the AS Java LM Configuration Wizard. By leveraging this vulnerability, attackers can execute malicious code to create administrative users, potentially compromising both the target AS Java system and connected infrastructure.
In addition to the RECON patch, SAP addressed a high-risk information disclosure vulnerability within the XMLToolkit of AS Java, which could allow attackers to access sensitive system configuration files. Furthermore, updated patching instructions were released for an information disclosure vulnerability impacting AS ABAP, requiring specific prerequisite implementations. Security teams should prioritize the application of these notes to maintain system integrity and prevent unauthorized access. Where immediate patching is not possible, SAP provides specific workarounds, such as disabling affected services like the LM Configuration Wizard, to mitigate the risk until a permanent fix can be deployed.
Key Takeaways
- Critical RECON Vulnerability: Patch 2934135 secures the LM Configuration Wizard against unauthorized code execution and administrative user creation.
- Information Disclosure: Note 2932473 fixes a flaw in AS Java’s XMLToolkit that could expose sensitive system configuration data.
- AS ABAP Security: Updated instructions in Note 2734580 address an information disclosure vulnerability, requiring Note 2091403 as a prerequisite.
- Workaround Availability: If patching is delayed, administrators can disable the LM Configuration Wizard per Note 2939665.
What is the RECON vulnerability?
The RECON vulnerability is a critical security flaw in NetWeaver Application Server Java (AS Java) caused by missing authentication in the LM Configuration Wizard. Attackers can exploit this to execute malicious code and create administrative users, leading to the full compromise of the affected system and potentially its connected systems.
How can I mitigate RECON if I cannot patch immediately?
If you cannot immediately implement Note 2934135, you can disable the LM Configuration Wizard as a temporary workaround. Procedures for disabling the application tc~lm~ctc~cul~startupapp are detailed in SAP Note 2939665.
Which vulnerabilities were addressed in July 2020?
The July 2020 updates addressed three primary security issues across SAP AS Java and AS ABAP environments.
| Vulnerability | Component | SAP Note | Impact |
|---|---|---|---|
| RECON | AS Java (LM Config Wizard) | 2934135 | Critical (Code execution/Auth bypass) |
| Information Disclosure | AS Java (XMLToolkit) | 2932473 | High (Sensitive file exposure) |
| Information Disclosure | AS ABAP | 2734580 | Medium/High (Data exposure) |
Frequently Asked Questions
Is there support for implementing the RECON patch?
Yes, SAP provides a Knowledge Base Article (KBA) 2948106 that includes FAQs to support the implementation of the critical patch for the RECON vulnerability.
What is the prerequisite for Note 2734580?
Note 2734580, which addresses an information disclosure vulnerability in AS ABAP, requires that Note 2091403 be implemented first.
Can the XMLToolkit vulnerability expose system data?
Yes, the vulnerability addressed by Note 2932473 could be exploited to read arbitrary files, including files that contain sensitive system configuration data.