Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. Other SAP Solutions
  4. /
  5. SAP Cloud Connector
  6. /
  7. SAP Cloud Connector - Known CVEs
Edit page

SAP Cloud Connector - Known CVEs

Description

An unauthenticated network fingerprint (TLS handshake, GET /, GET /scc/ui, favicon hash, GET /api/monitoring/versions against the admin UI on 8443) extracts a best-effort SCC build version, which is then matched against a small table of (min_version, max_version, cve_id) ranges. A finding is suspected when the version falls in the documented range, and would be promoted to confirmed if a captured JS-bundle hash matched a known-vulnerable build’s fingerprint (no such hash is currently populated for any entry, so this promotion path is presently dormant).

Risk

CVE-2024-25642 - Improper Certificate Validation in SAP Cloud Connector (CWE-295). CVSS 3.0 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). A regression in SCC 2.15.0–2.16.1, fixed in 2.16.2, confirmed via SAP Note 3424610 ("[CVE-2024-25642] Improper Certificate Validation in SAP Cloud Connector", released 13.02.2024, component BC-MID-SCC): “Due to improper validation of certificate in SAP Cloud Connector, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication… There is no impact on the availability of the system.”

Independently disclosed by SEC Consult (SA-20240513-0, “Tolerating Self-Signed Certificates in SAP® Cloud Connector”): the affected builds accepted self-signed X.509 certificates on outbound TLS connections to two specific BTP hostnames (connectivitynotification.cf.us10.hana.ondemand.com, connectivity.us10.trial.applicationstudio.cloud.sap), defeating the mutual-authentication guarantee between SCC and BTP. SEC Consult demonstrated the exploit via /etc/hosts redirection plus a matching self-signed certificate - the connection succeeded with no warning. The AC:H component reflects that exploitation requires an on-path/MITM network position capable of intercepting or redirecting the connector’s outbound connection to one of those two hostnames - this is a network-position-dependent finding on the SCC-to-BTP transport, not a direct on-prem RCE primitive.

Options

  • Fingerprint (pre-auth, no credentials): TLS handshake → GET / (redirect to /scc/ui) → GET /scc/ui (HTML markers, JS-bundle hash) → favicon SHA-256/MurmurHash3 → GET /api/monitoring/versions (401 on a modern, correctly-configured build; an unexpected 200 is itself informative and yields the highest-confidence version string).
    openssl s_client -connect host:8443
curl -k -I https://host:8443/
curl -k https://host:8443/scc/ui
  • Version-range match: any observed version in [2.0.0, 2.16.2) is flagged suspected for CVE-2024-25642. This lower bound (2.0.0) is deliberately wider than the confirmed regression window (2.15.0–2.16.1) - over-flag by design. Manually confirm the actual build before treating a suspected hit on a version below 2.15.0 as credible.
  • Manual equivalent: cross-reference the extracted version against the SAP Cloud Connector Patch and Version History page and an NVD CPE search - treat any static bucket table as lagging new disclosures.
  • An empty match result must be read as “no rule matched,” never as “this version has no vulnerabilities.”

Mitigation

  • Upgrade SAP Cloud Connector to ≥ 2.16.2 and apply SAP Note 3424610.
  • Track SCC patch-day notes via the SAP Cloud Connector Patch and Version History page directly, rather than relying solely on a static version-bucket table.
  • Restrict SCC admin-UI network reachability (8443 by default) to a dedicated management network/VPN - reduces the value of version fingerprinting to an attacker and closes off the pre-auth recon step entirely.

Detection and Monitoring

  • No target-side telemetry exists for exploitation of CVE-2024-25642 itself beyond egress/network monitoring: watch the SCC host’s outbound TLS connections to its configured BTP connectivity endpoints (connectivitynotification/connectivitytunnel.<region>.hana.ondemand.com-class hostnames) for certificates that do not chain to SAP’s expected CA.
  • Pre-auth fingerprint recon is itself detectable: a distinctive non-browser User-Agent string, and a single source IP issuing GET /, GET /scc/ui, the favicon fetch, and GET /api/monitoring/versions in rapid (sub-second to few-second) succession - not normal browser navigation.
  • Repeated 401 responses on /api/monitoring/versions from a source IP with no prior successful admin-UI login is a pre-auth-recon indicator.
  • Flag any 8443 exposure reachable outside the intended management network/VPN discovered via external attack-surface scanning - the exposure itself is the primary finding, independent of patch level.

References