A Crushing Blow At the Heart of SAP J2EE Engine

Presented at Black Hat USA 2011, Aug. 4, 2011, 3:15 p.m. (75 minutes).

Nowadays SAP NetWeaver platform is the most widespread platform for developing enterprise business applications. It's becoming a popular security topic but still not covered well. This talk will be focused on one of the black holes called SAP J2EE engine. Some of the critical SAP products like SAP Portal, SAP Mobile, SAP XI and many other applications lay on J2EE engine which is apart from ABAP engine is less discussed but also critical. I will explain architecture of SAP's J2EE engine and give a complete tour into its internals. After that I will show a number of previously unknown architecture and program vulnerabilities from auth bypasses, smbrelays, internal scans, xml/soap attacks to insecure encryption algorithms and cross-system vulnerabilities in J2EE platform. Finally it will be presented chained attack which use multiple logic vulnerabilities and give a full control on any version of SAP's J2EE Engine on any platform. A free tool will be presented to automatically scan custom applications against this attack

Presenters:

• Alexander Polyakov

Links:

• https://www.blackhat.com/html/bh-us-11/bh-us-11-archives.html#Polyakov
• https://media.blackhat.com/bh-us-11/Polyakov/BH_US_11_Polyakov_J2EE_Engine_Slides.pdf
• https://media.blackhat.com/bh-us-11/Polyakov/BH_US_11_Polyakov_J2EE_Engine_WP.pdf

Similar Presentations:

• DEF CON 20 (2012) / Uncovering SAP Vulnerabilities: Reversing and Breaking the Diag Protocol
• DeepSec 2017 „Science First!“ / SAP CTF Pentest : From Outside To Company Salaries Tampering (closed)
• DeepSec 2018 „I like to mov &6974,%bx“ / ERP Security: Assess, Exploit and Defend SAP Platforms