Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. Other SAP Solutions
  4. /
  5. SAP HANA DB
  6. /
  7. SAP HANA Default Users, Credential Harvesting & Privilege Escalation
Edit page

SAP HANA Default Users, Credential Harvesting & Privilege Escalation

Description

Every SAP HANA installation ships with a fixed set of well-known technical accounts, and HANA’s XS/XSA development model concentrates enormous privilege in a single system account. Together these give a pentester two distinct entry points once any foothold or credential is obtained: weak/reused installation-time passwords on the superuser account, and definer-mode privilege escalation through the repository-object ownership model.

  • SYSTEM - created at installation, holds extensive administrative privileges (including USER ADMIN, ROLE ADMIN). Unlike ABAP’s SAP*/DDIC, HANA does not ship SYSTEM with a fixed factory password - the installer prompts for one - but in practice this password is frequently set to an organization-wide standard build password and reused unchanged across landscape tiers (DEV/QA/PRD), making it a first-class credential-stuffing/reuse target.
  • SYS - technical superuser owning core system catalog objects; login is disabled by design.
  • _SYS_REPO - owns every repository (design-time) object: activated roles, calculation views, HDI containers, procedures. No standard GRANT/REVOKE works on repository objects - only _SYS_REPO-schema stored procedures (GRANT_PRIVILEGE_ON_ACTIVATED_CONTENT, GRANT_SCHEMA_PRIVILEGE_ON_ACTIVATED_CONTENT) can delegate access, and login as _SYS_REPO itself is disabled.
  • _SYS_AFL, _SYS_EPM, and other _SYS_* technical accounts - own Application Function Library and Performance Management objects respectively; no login.
  • Restricted users - an account class with CREATE ANY on own schema denied and ODBC/JDBC access denied by default; intended for XS-application end users but frequently misconfigured with excess PUBLIC-role-equivalent grants.

Definer vs. invoker mode is the privilege-escalation lever: a stored procedure or function created SQL SECURITY DEFINER (the default, and the least-restrictive option) executes with the creator’s privileges, not the caller’s - the creator must hold WITH GRANT OPTION on every referenced object to make this work, effectively delegating those privileges to anyone granted EXECUTE. Most HANA repository objects (calculation views, HDI-container procedures) are activated by _SYS_REPO on the developer’s behalf, so a SQL-injectable definer-mode procedure or calculation view is a direct path toward the underlying object owner’s effective privilege set.

Ports: 3<instance>13 (SQL, hdbsql), 3<instance>15 (HTTP/HTTPS - XSA controller / XS app router).

Risk

  • CVE-2026-0492 - Privilege Escalation in SAP HANA database (CWE-306, Missing Authentication for Critical Function). CVSS 3.0 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Confirmed via SAP Note 3691059 (released 13.01.2026): “SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access.” Affects SAP HANA 2.00; SPS05/SPS06 explicitly not affected; fixed at SPS07 revision 79.07 and SPS08 revision 88. No workaround - patch only. SAP did not disclose the exact user-switching mechanism in the note.
  • CVE-2019-0261 - Missing authentication check in SAP HANA XS advanced (CWE-306). SAP-rated CVSS 3.0 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Confirmed via SAP Note 2742027: XS advanced runtime 1.0.97–1.0.99 running on HANA 1 or HANA 2 SPS0 does not correctly perform authentication checks for XSA platform and business users, enabling unauthorized access to sensitive data and privileged functionality. Fixed in XSA 1.0.100+; a workaround (disabling the OIDC component) is documented but disables X.509/SPNEGO SSO as a side effect.
  • CVE-2016-6144 - Insufficient login-attempt limiting for SYSTEM (CWE-284). CVSS 3.0 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Confirmed via SAP Note 2216869: prior to HANA Revision 102, SYSTEM was excluded from the account-lockout policy, enabling unthrottled password brute-forcing, and detailed logon-failure error messages (user is locked, user is deactivated) enabled user enumeration. <!-- VERIFY: HANA 1.0-era finding (Rev 97/102); confirm target revision before relying on this - long since fixed on any current HANA 2.0 SPS, but the two indexserver.ini parameters below remain worth checking on legacy estates. -->
  • Definer-mode SQL injection → _SYS_REPO-adjacent privilege escalation is a documented design property of the HANA repository model (not a single CVE) per the SAP HANA 2.0 Security Guide: a SQL-injectable definer-mode procedure or an application accepting attacker input into dynamic SQL inside such a procedure inherits the creator’s privileges for that execution - commonly broader than the calling (often restricted/XS) user’s own grants.

Options

  • Credential harvesting from the application-server filesystem (no HANA credentials needed if OS/RFC access to a connected AS ABAP/Java is already held):
    hdbuserstore LIST
hdbsql -U DEFAULT
    hdbuserstore (the HDB User Store) persists DB-connect credentials encrypted at /home/<sidadm>/.hdb/<hostname>/SSFS_HDB.DAT; any key listed by hdbuserstore LIST (commonly DEFAULT, SAPABAP1) can be used directly with hdbsql -U <key> without ever seeing the plaintext password - decrypt the underlying SSFS pair per Decrypting SAP Secure Storage if plaintext extraction is required.
  • SYSTEM / weak-password testing: hdbsql -u SYSTEM -p '<candidate>' -n <host>:3<NN>13 - worth a short, rate-limited candidate list (organization’s known standard build password, sidadm password reused, vendor-default strings) given SYSTEM is operator-set at install rather than a documented fixed value; on unpatched revisions (<!-- VERIFY target revision against CVE-2016-6144 fix (Rev 102) -->) the account is exempt from lockout, removing the throttling that would otherwise limit this.
  • Enumerate account posture pre-attack:
    SELECT USER_NAME, USER_DEACTIVATED, PASSWORD_CHANGE_TIME FROM SYS.USERS;
SELECT * FROM SYS.INVALID_CONNECT_ATTEMPTS;
SELECT * FROM GRANTED_PRIVILEGES WHERE PRIVILEGE IN ('USER ADMIN','ROLE ADMIN');
  • Definer-mode SQLi → escalation: identify an XSA/XSC application (calculation view, .hdbprocedure, XSJS/Node.js service) that concatenates unsanitized input into dynamic SQL (EXEC 'SELECT ... ' || :input) inside a SQL SECURITY DEFINER procedure; a successful injection executes with the procedure creator’s effective privileges rather than the restricted caller’s - check the procedure’s SQL SECURITY mode via SELECT SQL_SECURITY FROM PROCEDURES WHERE ... before investing injection effort. Because _SYS_REPO activates and owns most repository content on the developer’s behalf, a definer-mode procedure created by a highly-privileged developer role is the highest-value target.
  • CVE-2026-0492 exploitation requires only valid credentials for any user on an affected, unpatched HANA 2.00 SPS07/SPS08 build; SAP’s note gives no further technical detail on the injection point - treat as <!-- VERIFY --> for the specific technique and rely on version fingerprinting (SELECT VERSION FROM SYS.M_DATABASE;) plus the SAP-confirmed fixed revisions above to flag exposure.

Mitigation

  • Set a strong, unique SYSTEM password per landscape tier at install time; disable SYSTEM post-setup (ALTER USER SYSTEM DEACTIVATE) and reactivate only for emergency use with full audit.
  • Patch to HANA 2.00 SPS07 rev ≥79.07 / SPS08 rev ≥88 (SAP Note 3691059) and XS advanced ≥1.0.100 (SAP Note 2742027).
  • On any legacy estate below HANA Rev 102, set password_lock_for_system_user = true and detailed_error_on_connect = false in [password_policy] of indexserver.ini (SAP Note 2216869).
  • Prefer SQL SECURITY INVOKER for procedures/functions unless definer-mode is a specific, reviewed requirement; audit all definer-mode objects for unsanitized dynamic SQL.
  • Restrict hdbuserstore key files to <sid>adm-only filesystem permissions; rotate any key exposed via OS/RFC compromise.
  • Restrict USER ADMIN, ROLE ADMIN, and EXECUTE on _SYS_REPO.GRANT_* procedures to a small, audited security-administration group.

Detection and Monitoring

  • SYS.INVALID_CONNECT_ATTEMPTS and SYS.USERS.INVALID_CONNECT_ATTEMPTS - repeated failed logons, especially against SYSTEM.
  • Authorization trace (ALTER SYSTEM ALTER CONFIGURATION / SAP HANA cockpit trace UI) targeted at a suspected user shows every denied action plus the specific missing privilege - useful for confirming exploitation attempts, not just defending against them.
  • SYS.EFFECTIVE_PRIVILEGE_GRANTEES - periodic diff against a known-good baseline for unexpected USER ADMIN/ROLE ADMIN grants.
  • Filesystem access-auditing on SSFS_HDB.{DAT,KEY} under /home/<sidadm>/.hdb/ and /usr/sap/<SID>/SYS/global/security/rsecssfs/ by any account other than <sid>adm.
  • Review SQL SECURITY mode on all custom procedures/functions in PROCEDURES/FUNCTIONS system views; flag any definer-mode object callable by a restricted or low-privilege role.

References