LM Configuration Wizard (CVE-2020-6287)

RECON (“Remotely Exploitable Code On NetWeaver,” Onapsis, July 2020) is a missing-authentication flaw in the LM Configuration Wizard component of SAP NetWeaver AS Java. The wizard’s Central Technical Configuration (CTC) web service - /CTCWebService/CTCWebServiceBean - performs no authentication check, so an unauthenticated attacker reachable on the HTTP(S) port (5NN00/5NN01, see Network Service Discovery) can invoke configuration tasks against the Java stack, including creating a new administrative UME user. That single primitive is full confidentiality/integrity/availability compromise of the AS Java system and every application on it (Portal, PI/PO, Solution Manager Diagnostics).

A second flaw fixed in the same note, CVE-2020-6286, is an unauthenticated path traversal in the same web service that lets an attacker download ZIP files to a chosen directory - chainable with the user-creation primitive for file-stage-then-execute scenarios.

Because the vector is a single unauthenticated HTTP request set and the affected component ships enabled by default, RECON was mass-scanned within days of disclosure; a reachable, unpatched CTCWebService should be treated as already-compromised until proven otherwise.

• CVE-2020-6287 - Missing Authentication in LM Configuration Wizard (CWE-306). CVSS 3.0 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Confirmed via SAP Note 2934135: the wizard “does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks … including the ability to create an administrative user.” Component BC-INS-CTC; affects LMCTC 7.30, 7.31, 7.40, 7.50 (AS Java). Released 28.07.2020.
• CVE-2020-6286 - Path Traversal in the same web service (CWE-22). CVSS 3.0 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Insufficient input-path validation lets an unauthenticated attacker download ZIP files to a specific directory. Same note, same affected releases.

An attacker-created UME administrator inherits full NWA/useradmin/Portal control and, from there, deployment and OS-adjacent capability (deploy a malicious EAR/WAR, read the AS Java Secure Store to harvest the master password and connection secrets, then pivot into every backend the Java stack trusts).

• Fingerprint the endpoint (unauthenticated) - a reachable CTC web service is itself the finding, before any exploitation:

  HEAD /CTCWebService/CTCWebServiceBean HTTP/1.1
  GET  /CTCWebService/CTCWebServiceBean?wsdl HTTP/1.1
  

  A 200 (or a served WSDL) on 5NN00/5NN01 is a strong signal of an exposed, possibly-unpatched LM Configuration Wizard. The application alias tc~lm~ctc~cul~startup_app is the associated component name.
• Exploit (user creation) - an unauthenticated SOAP request to CTCWebServiceBean invokes a CTC configuration task that creates a UME user and assigns it an administrative role. Public, maintained implementations exist:
  • Nuclei template for CVE-2020-6287 (safe detection).
  • Metasploit auxiliary/exploit modules for RECON user creation.
  • The Onapsis RECON scanner / threat report (detection guidance and IOCs).
• Chain CVE-2020-6286 - the path-traversal ZIP-download primitive can stage a file to a web-reachable or deploy-watched directory; combined with the admin-user primitive it broadens from account creation toward file-staged execution. Confirm patch level before investing (GET /nwa version tile, or the fingerprints in Network Service Discovery).
• Post-exploitation - once an admin UME identity is held, treat it as full AS Java compromise: deploy code, and harvest stored secrets per AS Java Credential-Material Taxonomy.

• Patch immediately to the fixed LM Configuration Wizard build per SAP Note 2934135 - this is a CVSS 10.0, actively-exploited flaw.
• If the patch cannot be applied at once, apply the SAP-documented workaround from SAP Note 2939665: disable the CTC application aliases. SAP notes these aliases are needed only for a few lifecycle procedures (e.g. initial technical setup), not day-to-day operation, and can be temporarily re-enabled when required - this is defense-in-depth, not a substitute for the patch.
• Restrict HTTP(S) reachability of the AS Java administrative surface (/CTCWebService, /nwa, /useradmin) to a management network/VPN; it should never be internet-facing.
• Review UME administrator accounts for any user created outside the change process (see Detection).

• HTTP access logs (ICM / web dispatcher) for requests to /CTCWebService/CTCWebServiceBean, especially POSTs from untrusted sources and without a prior authenticated session - the core RECON IOC.
• UME audit for administrative user-creation and role-assignment events that do not correspond to an approved change; a newly-created admin account is the primary post-exploitation artifact.
• Retroactively hunt for CTCWebService hits in historical logs - given the 2020 mass-scanning, an unpatched system may already carry an attacker-created account predating the assessment.
• Correlate any CVE-2020-6286 ZIP-download traffic (path-traversal patterns against the CTC service) with subsequent deployment or file-staging activity.

• SAP Note 2934135 - [CVE-2020-6287] Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard)
• SAP Note 2939665 - RECON workaround (disable CTC application aliases)
• NVD - CVE-2020-6287
• NVD - CVE-2020-6286
• Onapsis - RECON vulnerability research and threat report
• Network Service Discovery & Fingerprinting
• Technology Overview
• AS Java Credential-Material Taxonomy