The June 2020 SAP Security Notes address a critical remote code execution vulnerability in SAP Liquidity Management for Banking, updates for hard-coded credentials in SAP Commerce, and privilege escalation risks in SAP SuccessFactors Recruiting. Organizations should prioritize patching these components to maintain system integrity and security.
Executive Summary
In June 2020, SAP released several critical security advisories affecting key enterprise platforms. The most severe issue identified is a remote code execution vulnerability in SAP Liquidity Management for Banking, which stems from the Apache JServ Protocol (AJP) in Apache Tomcat. To mitigate this, organizations must either disable the AJP Connector or secure it with a secret key.
Additionally, SAP addressed hard-coded credentials in SAP Commerce and SAP Commerce Datahub, providing specific scripts to remediate these vulnerabilities in existing installations. Further updates include patches for a privilege escalation risk in SAP SuccessFactors Recruiting and information disclosure vulnerabilities affecting both SAP Commerce and SAP NetWeaver Application Server ABAP (AS ABAP). Reviewing these notes and applying the recommended remediation steps is essential for protecting SAP environments.
Key Takeaways
- Critical RCE: A remote code execution vulnerability in SAP Liquidity Management for Banking requires disabling or securing the AJP Connector.
- Credential Hardening: New installations of SAP Commerce have discontinued default passwords, while existing installations require remediation scripts.
- Privilege Escalation: A vulnerability in SAP SuccessFactors Recruiting due to a missing authorization check has been patched.
- Information Disclosure: High-priority patches were released for SAP Commerce and SAP NetWeaver AS ABAP to prevent information disclosure.
Which SAP Security Notes Were Released in June 2020?
The following table summarizes the key SAP security advisories released in June 2020, highlighting the affected products and the nature of the vulnerabilities.
| SAP Note | Affected Product/Component | Vulnerability Type |
|---|---|---|
| 2928570 | SAP Liquidity Management for Banking | Remote Code Execution |
| 2918924 | SAP Commerce / SAP Commerce Datahub | Hard-coded Credentials |
| 2933282 | SAP SuccessFactors Recruiting | Privilege Escalation |
| 2906366 | SAP Commerce | Information Disclosure |
| 2734580 | SAP NetWeaver AS ABAP | Information Disclosure |
How Do I Secure SAP Liquidity Management Against RCE?
To secure SAP Liquidity Management for Banking against the remote code execution vulnerability, you should address the AJP Connector in Apache Tomcat. SAP recommends either blocking AJP connections if they are not required by disabling the AJP Connector, or securing existing AJP connections with a secret key. Manual procedures for these steps are provided in note 2928570.
How Should I Remove Hard-Coded Credentials in SAP Commerce?
SAP has discontinued the use of default passwords for admin and other built-in accounts in new installations of SAP Commerce. For existing installations, because re-initializing the system would delete all application data, you must use the remediation scripts provided in note 2922193 to remove default credentials securely.
FAQ
What is the primary risk identified in the June 2020 SAP security update?
The primary risk is a critical remote code execution vulnerability in SAP Liquidity Management for Banking related to the Apache JServ Protocol (AJP) in Apache Tomcat.
How does the update affect SAP Commerce installations?
The update addresses hard-coded credentials in SAP Commerce and SAP Commerce Datahub. While new installations no longer use default passwords, existing installations require specific scripts from note 2922193 to remove them.
Are there updates for SAP SuccessFactors Recruiting?
Yes, note 2933282 addresses a missing authorization check in SAP SuccessFactors Recruiting that could potentially lead to an escalation of privileges.