Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. Other SAP Solutions
  4. /
  5. SAP ASE Database (Sybase ASE)
  6. /
  7. SAP ASE - Known CVEs
Edit page

SAP ASE - Known CVEs

Description

A version/patch-level fingerprint (select @@version; post-auth, or a service banner from the Dataserver port pre-auth) matched against a table of SAP-Note-verified ASE CVEs. Nearly the entire public ASE CVE surface is one disclosure cluster - SAP Security Patch Day, May/June 2020 - remediated by a single pair of patch levels (16.0 SP02 PL09 HF1/HF2 or 16.0 SP03 PL08 HF1/HF2, plus 15.7 SP141 HF1/HF2 where the 15.7 line is affected). In practice this means one fingerprint decides most of the bucket at once: an ASE at or above those patch levels clears eight of the ten entries below.

ASE version strings expose the SP/PL but not always the hotfix (HF1/HF2) suffix, and the 2020 cluster is split precisely on that suffix. Treat a version-range hit as suspected until the hotfix level is confirmed via the installed-component list (sp_version) or the SAP Host Agent / SUM component inventory - do not report from @@version alone when the SP/PL is exactly at the boundary.

Risk

  • CVE-2020-6241 - SQL Injection in SAP Adaptive Server Enterprise (CWE-89). CVSS 3.0 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Confirmed via SAP Note 2916927: “An authenticated user on SAP ASE server may create object[s] that contain carefully crafted SQL statements. This allows the attacker to elevate their privileges, modify database objects, or execute commands they are not authorized to execute otherwise.” Affects ASE 16.0 prior to SP02 PL09 HF1 / SP03 PL08 HF1. SAP does not disclose the object type or injection point. <!-- VERIFY: no third-party technical writeup or PoC located; the generic SQLi-privesc finding is verified, the specific mechanism is not. Do not assert "dbcc import_sproc" as the confirmed vector. --> See Default Logins, Enumeration & Privilege Escalation.
  • CVE-2020-6253 - SQL Injection in SAP Adaptive Server Enterprise (Web Services) (CWE-89). CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Confirmed via SAP Note 2917273: an authenticated user executes crafted database queries through the ASE Web Services interface to elevate privileges, modify database objects, or execute unauthorized commands. Affects ASE 15.7 / 16.0 prior to 15.7 SP141 HF1 / 16.0 SP02 PL09 HF1 / SP03 PL08 HF1. Only reachable where ASE Web Services is deployed and started - check before spending effort.
  • CVE-2020-6243 - Code Injection in ASE (XP Server, Windows only) (CWE-94). NIST CVSS 3.1 8.8 / SAP-rated CVSS 3.0 8.0 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H). Confirmed via SAP Note 2915585: XP Server - the component that runs extended stored procedures with OS-level privileges - omits required checks for an authenticated user executing an extended stored procedure, allowing read/modify/delete of restricted data on connected servers. Affects ASE 15.7 and 16.0, Windows only; fixed at 15.7 SP141 HF1 / 16.0 SP02 PL09 HF1 / SP03 PL08 HF1.
  • CVE-2020-6248 - Code Injection in ASE (Backup Server) (CWE-20, CWE-94). NIST CVSS 3.1 7.2 / SAP-rated CVSS 3.0 9.1 CRITICAL (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Confirmed via SAP Note 2917275: Backup Server misses validation checks for an authenticated user executing DUMP/LOAD, allowing arbitrary code execution. Affects ASE 16.0 SP03 PL04 and later PLs prior to SP03 PL08 HF1. Narrowest version window in the bucket - PL04 through PL07 only.
  • CVE-2020-6252 - Information Disclosure in ASE (Cockpit, Windows only). NIST CVSS 3.1 8.0 / SAP-rated CVSS 3.0 9.0 CRITICAL (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Confirmed via SAP Note 2917090: insufficient authorization checks in SAP ASE Cockpit let an attacker with local-network access obtain otherwise-restricted sensitive information - including user account credentials - and tamper with system data. Affects ASE 16.0 prior to SP02 PL09 HF1 / SP03 PL08 HF1. AV:A means adjacent network: reachability to the Cockpit web port is the precondition, not an OS foothold.
  • CVE-2020-6250 / CVE-2020-6295 / CVE-2020-6317 - Installation-log credential disclosure. SAP Note 2917022 (CVE-2020-6250, CVSS 6.8, AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H): an authenticated attacker exploiting misconfigured endpoints over the adjacent network reads the system administrator password from a log file - Linux/UNIX only, ASE 16.0 SP03 prior to PL08 HF1. SAP Note 2941332 (CVE-2020-6295, CVSS 7.0) and SAP Note 2953203 (CVE-2020-6317, CVSS 2.6): the ASE Cockpit installer writes encrypted-but-still-sensitive information into publicly/locally readable installation logs - fixed at 16.0 SP02 PL09 HF2 / SP03 PL08 HF2 (and 15.7 SP141 HF2 for CVE-2020-6317). These three are the only entries in the bucket fixed at HF2, not HF1 - a host patched to HF1 still carries them.
  • CVE-2022-31594 - Privilege escalation in ASE (sybctrl SUID). CVSS 3.0 3.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N). Confirmed via SAP Note 3155571 and independently disclosed by SEC Consult: the SUID-root sybctrl binary at /usr/sap/<SAPSID>/SYS/exe/run/sybctrl follows a symbolic link when writing error-log messages, letting a highly-privileged local user escalate to root. Scope caveat, stated explicitly in the note: “Non-Business Suite usage of ASE is not affected by this note; this note refers to usage of SAP NetWeaver ABAP or Java Stack on SAP ASE only.” - applies to ASE as the DB layer under a NetWeaver install (KERNEL/KRNL64UC component), not to standalone Sybase ASE. Fix: SUID bit removed from the shipped binary; workaround chmod 0755.
  • CVE-2022-22528 - Uncontrolled search path in the ASE Windows installer (CWE-427). CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Confirmed via SAP Note 3140564: the ASE 16.0 Windows installer prepends a SYBASE-related entry to the system %PATH%, letting a standard user plant a malicious binary earlier in the search path and have it executed with elevated context. Installer-only; other ASE binaries unaffected. Fixed at 16.0 SP03 PL11 / SP04 PL01 HF1 - note this is a later patch level than the 2020 cluster, so a host patched only to SP03 PL08 HF2 remains exposed.

Options

  • Fingerprint (post-auth, any valid login):
    select @@version;
exec sp_version
    @@version gives the SP/PL string; sp_version lists installed component versions and is the better source when the hotfix suffix matters.
  • Fingerprint (pre-auth, network only): the Dataserver port returns a TDS login response that can suggest a major line (15.7 vs 16.0) but does not reliably yield SP/PL/HF - treat any pre-auth version claim as suspected and confirm post-auth before reporting. Port layout and scanning syntax in Service discovery & enumeration.
  • Version-range match:
    • ASE 16.0 < SP02 PL09 HF1 or < SP03 PL08 HF1 -> suspected CVE-2020-6241, -6243, -6252, -6253
    • ASE 15.7 < SP141 HF1 -> suspected CVE-2020-6243, -6253
    • ASE 16.0 < SP02 PL09 HF2 / SP03 PL08 HF2, or 15.7 < SP141 HF2 -> suspected CVE-2020-6295, -6317
    • ASE 16.0 SP03, PL04-PL07 -> suspected CVE-2020-6248
    • ASE 16.0 SP03 < PL08 HF1, Linux/UNIX -> suspected CVE-2020-6250
    • ASE 16.0 Windows < SP03 PL11 / SP04 PL01 HF1 -> suspected CVE-2022-22528
    • ASE under a NetWeaver ABAP/Java stack, sybctrl carrying the SUID bit -> suspected CVE-2022-31594 (verify by file mode, not version - see below)
  • Platform gates before spending effort: CVE-2020-6243 and -6252 are Windows only; CVE-2020-6250 is Linux/UNIX only; CVE-2022-22528 is Windows installer only; CVE-2022-31594 requires the Business Suite-on-ASE configuration.
  • The sybctrl entry is confirmable without a version at all:
    ls -la /usr/sap/<SAPSID>/SYS/exe/run/sybctrl   # rwsr-xr-x = SUID present = unpatched
  • An empty match reads as “no rule matched,” never “this ASE has no vulnerabilities” - this table covers only what was verified against SAP Note + NVD this pass.

Mitigation

  • Single remediation target clears eight of ten entries: patch to ASE 16.0 SP02 PL09 HF2 or SP03 PL08 HF2 (15.7 line: SP141 HF2). HF2 rather than HF1, since the three installation-log CVEs are only fixed at HF2.
  • Patch Windows installs to 16.0 SP03 PL11 / SP04 PL01 HF1 (SAP Note 3140564) for CVE-2022-22528, or as an interim workaround correct the %PATH% ordering (append rather than prepend the SYBASE entries).
  • Remove the SUID bit from sybctrl (chmod 0755 /usr/sap/<SAPSID>/SYS/exe/run/sybctrl) per SAP Note 3155571; start the database via SAP Host Agent’s StartDatabase command, which does not need the SUID path.
  • Delete or rotate credential-bearing installation logs after setup and restrict the install-log directory to administrators - patching stops new writes but does not clean up logs already on disk.
  • Disable ASE Web Services if not in active use - removes the CVE-2020-6253 surface outright rather than patching it.
  • Subscribe to SAP Security Patch Day notes for component BC-SYB-ASE rather than relying on this static bucket, which lags new disclosures.

Detection and Monitoring

  • No CVE-specific target-side telemetry beyond the linked technique page - see Default Logins, Enumeration & Privilege Escalation for per-technique detection guidance.
  • File-integrity monitoring on /usr/sap/<SAPSID>/SYS/exe/run/sybctrl for the SUID bit reappearing after a patch or upgrade - kernel updates have re-shipped it.
  • Flag any Dataserver (4901) or Backup Server (4902) port reachable outside the intended DB/application network as a standalone finding, independent of patch level.
  • Flag any ASE Cockpit web port reachable beyond the management network - CVE-2020-6252 is AV:A, so network placement is the control that matters most.

References