CVE-2020-6286
published 2020-07-14CVE-2020-6286: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40…
PriorityP179medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
28.31%
97.9th percentile
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap | netweaver_application_server_java | — | — |
| sap_se | sap_netweaver_as_java | < 7.30 | 7.30 |
| sap_se | sap_netweaver_as_java | < 7.31 | 7.31 |
| sap_se | sap_netweaver_as_java | < 7.40 | 7.40 |
| sap_se | sap_netweaver_as_java | < 7.50 | 7.50 |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> any any (msg:"ET EXPLOIT SAP NetWeaver AS Directory Traversal Attempt Inbound (CVE-2020-6286)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:""; distance:0; content:"../../../"; within:10; fast_pattern; reference:url,github.com/chipik/SAP_RECON/blob/master/RECON.py; reference:cve,2020-6286; classtype:attempted-user; sid:2030549; rev:3; metadata:created_at 2020_07_16, cve CVE_2020_6286, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre_technique_name File_And_Directory_Discovery; target:dest_ip;)
bytes
../../../
- →The exploit uses HTTP POST requests containing a path traversal sequence '../../../' in the request body, targeting the SAP NetWeaver AS JAVA LM Configuration Wizard web service endpoint.
- →A public PoC script (RECON.py by researcher Dmitry Chastuhin / chipik) is available on GitHub and allows downloading any zip file from a vulnerable SAP server; mass scanning activity was observed shortly after PoC publication. ↗
- →POC publication for CVE-2020-6286/6287 was quickly followed by mass scanning activity targeting SAP NetWeaver AS JAVA systems; monitor for anomalous scanning/probing of SAP HTTP endpoints. ↗
- →Check Point IPS blade detects exploitation attempts under the signature name 'SAP NetWeaver Directory Traversal (CVE-2020-6286)'. ↗
- ·CVE-2020-6286 affects SAP NetWeaver AS JAVA versions 7.30, 7.31, 7.40, and 7.50 specifically in the LM Configuration Wizard component; scope extends to all SAP Java-based solutions running on top of these versions. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xp68-m4r3-hpqf: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7
ghsa_unreviewed·2022-05-24
CVE-2020-6286 [MEDIUM] GHSA-xp68-m4r3-hpqf: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.
VulnCheck
SAP netweaver_application_server_java Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2020·CVSS 5.3
CVE-2020-6286 [MEDIUM] SAP netweaver_application_server_java Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
SAP netweaver_application_server_java Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a method to download zip files to a specific directory, leading to Path Traversal.
Affected: SAP netweaver_application_server_java
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://kevintel.com/CVE-2020-6286
Exploit PoC: https://vulncheck.com/xdb/dfa9a8a46ae0; https://vulncheck.com/xdb/3ea749d17e38
Suricata
ET EXPLOIT SAP NetWeaver AS Directory Traversal Attempt Inbound (CVE-2020-6286)
suricata·2020-07-16·CVSS 5.3
CVE-2020-6286 [MEDIUM] ET EXPLOIT SAP NetWeaver AS Directory Traversal Attempt Inbound (CVE-2020-6286)
ET EXPLOIT SAP NetWeaver AS Directory Traversal Attempt Inbound (CVE-2020-6286)
Rule: alert http $EXTERNAL_NET any -> any any (msg:"ET EXPLOIT SAP NetWeaver AS Directory Traversal Attempt Inbound (CVE-2020-6286)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:""; distance:0; content:"../../../"; within:10; fast_pattern; reference:url,github.com/chipik/SAP_RECON/blob/master/RECON.py; reference:cve,2020-6286; classtype:attempted-user; sid:2030549; rev:3; metadata:created_at 2020_07_16, cve CVE_2020_6286, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1083, mitre
No public exploits indexed.
HackerOne
Found multiple SAP NetWeaver vulnerable services
hackerone·2021-02-16·CVSS 5.3
[MEDIUM] Found multiple SAP NetWeaver vulnerable services
Found multiple SAP NetWeaver vulnerable services
# Summary:
Hello Team,
I found two (**redapi.acronis.com** and **redapi2.acronis.com**) sap Netweaver vulnerable services. They do not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity, and Availability of the system, leading to Missing Authentication Check.
# Steps To Reproduce:
1. Run the script {F1195428}
2. You will see random user created
# POC:
Just for the POC, I have created a random user with creds
sapRpoc9049:Secure!PwD6751 (at redapi.acronis.com)
{F1195413}
# References:
https://github.com/chipik/
Checkpoint
20th July – Threat Intelligence Bulletin
blogs_checkpoint·2020-07-20
CVE-2020-1350 20th July – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th July – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 20th July 2020, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
130 Twitter accounts have been compromised of which 45 high profile accounts were used to promote a cryptocurrency fraud that yielded more than $120K. An ad that appeared before the attack on a gray-market site offered to sell control of Twitter accounts. Investigators believe attackers used credentials for a Twitter bac
Tenable
CVE-2020-6287: Critical Vulnerability in SAP NetWeaver Application Server JAVA Disclosed (RECON)
blogs_tenable·2020-07-14·CVSS 10.0
[CRITICAL] CVE-2020-6287: Critical Vulnerability in SAP NetWeaver Application Server JAVA Disclosed (RECON)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
2020-07-14
Published
Exploited in the wild