CVE-2020-26820: 
SAP NetWeaver Application Server Java vulnerability analysis and mitigation

SAP NetWeaver AS JAVA, versions 7.20, 7.30, 7.31, 7.40, and 7.50, contains a critical vulnerability (CVE-2020-26820) that was disclosed on November 10, 2020. The vulnerability allows an authenticated administrator to exploit the administrator console to expose unauthenticated access to the file system and upload malicious files (NVD, CVE).

The vulnerability exists in the UDDI SERVER component of the SAP JAVA NetWeaver layer, which exposes functionality allowing authenticated attackers with NWA_SUPERADMIN privileges to upload resources. Due to lack of controls, uploaded files are not properly checked, enabling arbitrary file types to be uploaded. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 CRITICAL (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) by SAP SE, and is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (Onapsis Advisory).

The successful exploitation of this vulnerability allows attackers to execute operating system commands through the uploaded file, leading to privilege escalation and complete compromise of the confidentiality, integrity, and availability of the server operating system and any application running on it. This affects multiple SAP products running on top of SAP JAVA NetWeaver, including SAP Enterprise Portal, SAP Solution Manager, SAP PI/PO, and SAP Landscape Manager (Onapsis Advisory).

SAP has released security patches through SAP Note 2979062 to address this vulnerability. Organizations are strongly recommended to download and apply the security fixes to affected components to reduce business risks (Onapsis Advisory).