Key takeaways

From the discussions that rapidly emerged following the publication of CVE-2020-6287, we can learn the following:

  1. There is an increasing interest in vulnerabilities affecting ERP Applications by cybercriminals
  2. Prioritizing vulnerabilities is key to a sound security posture, incorporating multiple data points.

Why ERP Platforms Appeal to Threat Actors

We often talk about threat modeling which, as OWASP explains, “works to identify, communicate, and understand threats and mitigations within the context of protecting something of value”.

When we consider the protection of something of value, ERP platforms feature very highly. ERP platforms, such as SAP and Oracle, support key business processes such as payroll, logistics and billing. This means that there’s all sorts of potentially-lucrative information for threat actors to target, including financial results, manufacturing formulas, pricing, intellectual property, credit cards and personally identifiable information (PII) from employees, customers and suppliers. For a detailed view into these different types of campaigns, download a free copy of ERP Applications Under Fire, a paper Digital Shadows (now ReliaQuest) co-authored with Onapsis.

Rapid Emergence of Criminal Forum Discussions Around RECON

On 13 Jul 2020, SAP announced a new vulnerability in SAP Netweaver, CVE-2020-6287, discovered and reported to SAP by Onapsis. If exploited, this vulnerability would give a remote, unauthenticated attacker complete access to SAP systems, where they could steal sensitive data or disrupt systems. With a CVSS score of 10.0, this was clearly a critical vulnerability.

So how did the cybercriminal underground react? Using Shadow Search (now ReliaQuest GreyMatter Digital Risk Protection), Digital Shadows (now ReliaQuest)’ archive of collected data from criminal forums, paste sites, and other sources, we pieced together what happened next.

Within a day of the CVE being published on NIST NVD, users on the English-speaking dark web cybercriminal forum, Torum, began excitedly discussing SAP Recon (Figure 1). The thread closely followed developments to the vulnerability, including the release of the proof-of-concept (PoC) code on GitHub on 15 Jul 2020: https://github.com/chipik/SAP_RECON 

As is common with new PoC exploits, this vulnerability soon attracted the attention of users on XSS and Exploit, two popular Russian-speaking cybercriminal forums. Posts shown in Figures 2 and 3 show examples of these discussions.

Torum users dicusssing SAP RECON
Figure 1: Torum users discussing SAP RECON
XSS discussion. for CVE-2020-6287
Figure 2: XSS users begin discussing PoC for CVE-2020-6287. Date: 16 July 2020
Exploit code from Github
Figure 3: An Exploit[.] user sharing the POC exploit code from GitHub. Date: 18 Jul 2020

Social Media Activity

Online discussions of vulnerabilities and exploits are not just limited to criminal forums, of course. We can gauge the hype of exploits by also turning to social media. Tweets are displayed in Figure 4.

Tweets referencing CVE-2020-2687
Figure 4: Tweets referencing CVE-2020-6287 in July 2020 (Source: Shadow Search (now ReliaQuest GreyMatter Digital Risk Protection))

While this does not always correlate with the severity of the vulnerability in question, it does provide some indication as to the activity associated with it. For example, Figures 5 and 6 illustrate more recent cases (also posted during September) where security researchers have tweeted at specific companies with vulnerable services running.

Tweets referencing vulnerability services
Figure 5: Tweets referencing vulnerable services
Tweets referencing mass scanning and exploitation
Figure 6: Tweets referencing mass scanning and exploitation

Effectively Prioritizing Vulnerabilities

Prioritizing responses to vulnerabilities is a challenge for organizations of all sizes. In 2019 alone, there were 22,000 vulnerabilities published. Over the last month, there have been 1,714 references to SAP and Oracle on sites like NIST, NVD, and ExploitDB.

Post on NIST NVD and Exploit
Figure 7: Posts on NIST NVD and ExploitDB pertaining to Oracle or SAP vulnerabilities in the past six months. Source: Shadow Search (now ReliaQuest GreyMatter Digital Risk Protection)

Although CVSS score gives some indication of their criticality, it fails to paint the full picture. This scoring ought to be combined with information about the vulnerability. Some of the key questions are:

  1. Is it an RCE vulnerability?
  2. Does it have a PoC exploit available?
  3. Has it been exploited in the wild?
  4. Has this been discussed on criminal forums?
  5. Is there evidence of mass-scanning for this vulnerability?

By answering these questions, it’s possible to get the necessary context to effectively prioritize responses to vulnerabilities like RECON. This content series provides data points to address most of those questions.

References

 [1] ERP Applications Under Fire – How cyberattackers target the crown jewels

Keen to read more about RECON? Keep reading below.

The RECON Vulnerability Content Series

Back in July, SAP issued patches for the RECON vulnerability that was identified and disclosed to SAP by the Onapsis Research Labs. Because of the severity and the amount of potential vulnerable Internet exposed SAP systems, the DHS-CISA along with many other global organizations issued CERT Alerts warning organizations of the criticality of the RECON vulnerability. Both SAP and Onapsis urged organizations using SAP Applications to apply the patches immediately. In the days following the release of the patches for RECON, the Onapsis Research Labs and other security/threat intelligence organizations and researchers witnessed and reported rapid threat activity including scanning for vulnerable systems and ultimately weaponized exploit code posted publicly. This content is part of coordinated effort with threat intelligence experts, researchers and organizations to provide further insight, intelligence and actions you should take to ensure your organization is protected from the RECON vulnerability. All the parts can be found here: