Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

3/16/2017
12:30 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

ERP Attack Risks Come into Focus

New highly critical SAP vulnerability highlights dangers against critical business software.

Several developments this week recentered the security spotlight on some of the enterprise's most critical business systems as cybersecurity experts deal with the reality that enterprise resource planning (ERP) software needs heightened attention.

On the vulnerability front, SAP this week patched a new, highly critical vulnerability for SAP HANA with one of the highest severity ratings available. Meanwhile, a new survey report shows that security professionals are finally waking up to the fact that attackers are looking to leverage vulnerabilities like these, with indicated expectations of increased ERP attacks in the near future.

SAP HANA is an in-memory data platform used by enterprises to crunch data from across their business software stacks. Organizations use it to perform advanced analytics that inform critical business processes and fuel innovative applications, and as such it contains some of the most sensitive data pertaining to customers, business processes and intellectual property.  

The major vulnerability was discovered by ERP security firm Onapsis in SAP HANA's User Self-Service component and scored a CVSS vulnerability rating of 9.8, garnering a Hot News designation in this month's SAP Security Notes. If exploited, it would allow full remote compromise without access to any credentials.

"This level of access would allow an attacker to perform any action over the business information and processes supported by HANA, including creating, stealing, altering, and/or deleting sensitive information," says Sebastian Bortnik, head of research for Onapsis. "If these vulnerabilities are exploited, organizations may face severe business consequences."

According to Alexander Polyakov, CTO of ERPScan, this is definitely a big issue - but enterprises prioritizing ERP vulnerabilities should take the news with a grain of salt.

"The risk of these SAP HANA vulnerabilities is critical indeed," he says. "However, the likelihood of mass-exploitation is low as SAP HANA User Self-Service which contains the most dangerous issue is enabled only on 13% [of] Internet-exposed SAP systems according to a custom scan" by ERPScan, he says.

SAP patched the problem in this month's round of SAP Security Notes, which included 35 vulnerabilities across its portfolio. Among them there were eight vulnerabilities with a high priority rating.

Polyakov says his researchers are planning on drawing additional industry scrutiny on a critical vulnerability in the SAP GUI client, which he says has a much broader install base and could impact millions of SAP users. He says they're waiting to disclose technical information to enable SAP customers time to patch the vulnerability, but that the industry can look for details to come out of Troopers, a European security conference next week that will feature a special track on SAP security.

While there is a lot of work left to go, ERP security has increasingly hit the radar of enterprise security teams in the past few years.

"Just a few years ago, ERP security associated with separation of duties only and was hardly known even among cybersecurity experts," Polyakov says. "Nowadays, leading analysts consider it as an increasingly important topic and ERP vulnerabilities are covered by the international media."

Last year, the threats posed by these vulnerabilities tipped over from the theoretical realm to one of documented reality when US-CERT released a report that warned of at least 36 organizations worldwide impacted by attacks that leveraged a vulnerability in SAP's Invoker Servlet functionality running on SAP Java platforms.

This week, a new report from Crowd Research Partners found that 89% of security experts anticipate more attacks against ERP systems. Approximately 1 in 3 experts expect a significant increase in these attacks.

As things stand, most enterprises are still dreadfully unprepared for any attacks, let alone an increased volume of them. A report last year from Ponemon Institute showed that more than half of enterprises admit it would take their firm a year or longer to detect a breach in the SAP platform.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/30/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5991
PUBLISHED: 2020-10-30
NVIDIA CUDA Toolkit, all versions prior to 11.1.1, contains a vulnerability in the NVJPEG library in which an out-of-bounds read or write operation may lead to code execution, denial of service, or information disclosure.
CVE-2020-15273
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can ac...
CVE-2020-15276
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CVE-2020-15277
PUBLISHED: 2020-10-30
baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.
CVE-2020-7373
PUBLISHED: 2020-10-30
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is ...