VAITP Dataset

← Back to the dataset

CVE-2015-7828

SAP HANA Database < 1.00 SPS10 Unauthenticated Code Execution

  • CVSS 10.0
  • CWE-20
  • Authentication, Authorization, and Session Management
  • Remote

SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet to the (1) fcopydir, (2) fmkdir, (3) frmdir, (4) getenv, (5) dumpenv, (6) fcopy, (7) fput, (8) fdel, (9) fmove, (10) fget, (11) fappend, (12) fdir, (13) getTraces, (14) kill, (15) pexec, (16) stop, or (17) pythonexec method, aka SAP Security Note 2165583.

CVE
CVE-2015-7828
CWE
CWE-20
CVSS base score
10.0
Published
2015-11-10
OWASP
A01 Broken Access Control
Orthogonal defect classification
Function
Code defect classification
Missing Functionality
Category
Authentication, Authorization, and Session Management
Subcategory
Insecure Authentication Mechanisms
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Fixed by upgrading
Yes

Solution

Update to SAP HANA Database version 1.00 SPS11 or higher

Vulnerable code sample

from flask import Flask, request

app = Flask(__name__)

@app.route('/fcopydir', methods=['POST'])
@app.route('/fmkdir', methods=['POST'])
@app.route('/frmdir', methods=['POST'])
@app.route('/getenv', methods=['GET'])
@app.route('/dumpenv', methods=['GET'])
@app.route('/fcopy', methods=['POST'])
@app.route('/fput', methods=['POST'])
@app.route('/fdel', methods=['POST'])
@app.route('/fmove', methods=['POST'])
@app.route('/fget', methods=['GET'])
@app.route('/fappend', methods=['POST'])
@app.route('/fdir', methods=['GET'])
@app.route('/getTraces', methods=['GET'])
@app.route('/kill', methods=['POST'])
@app.route('/pexec', methods=['POST'])
@app.route('/stop', methods=['POST'])
@app.route('/pythonexec', methods=['POST'])
def handle_request():
    return "Request processed", 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

Patched code sample

from flask import Flask, request, abort

app = Flask(__name__)

def authenticate():
    auth = request.authorization
    if not auth or not (auth.username == 'admin' and auth.password == 'password'):
        abort(401)

@app.route('/fcopydir', methods=['POST'])
@app.route('/fmkdir', methods=['POST'])
@app.route('/frmdir', methods=['POST'])
@app.route('/getenv', methods=['GET'])
@app.route('/dumpenv', methods=['GET'])
@app.route('/fcopy', methods=['POST'])
@app.route('/fput', methods=['POST'])
@app.route('/fdel', methods=['POST'])
@app.route('/fmove', methods=['POST'])
@app.route('/fget', methods=['GET'])
@app.route('/fappend', methods=['POST'])
@app.route('/fdir', methods=['GET'])
@app.route('/getTraces', methods=['GET'])
@app.route('/kill', methods=['POST'])
@app.route('/pexec', methods=['POST'])
@app.route('/stop', methods=['POST'])
@app.route('/pythonexec', methods=['POST'])
def handle_request():
    authenticate()
    return "Request processed", 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

Cite this entry

@misc{vaitp:cve20157828,
  title        = {{SAP HANA Database < 1.00 SPS10 Unauthenticated Code Execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2015},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-7828},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-7828/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::