CVE DatabaseCVE-2020-6287

Updated 2026-06-17한국어 권고문 →

CVE-2020-628710.0/CRITICALCISA KEVCWE-306CWE-306

SAP NetWeaver AS JAVA LM Configuration Wizard Authentication Bypass and Remote Code Execution (CVE-2020-6287, RECON)

⚡ Jump to Patch

Affected Vendors

sap

Affected Components

netweaver_as_java

Published Date

2020-07-14

CVSS v3.1

10.0

CRITICAL

EPSS (30d)

N/A

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30, 7.31, 7.40, and 7.50

Impact

Unauthenticated remote attackers can execute configuration tasks, create administrative accounts, and fully compromise system confidentiality, integrity, and availability

Mitigation

Apply SAP Security Note 2934135 immediately or disable/restrict access to the CTC Web Service

Affected Products & Version Scope

SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30, 7.31, 7.40, and 7.50

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is to apply the official security patch provided by SAP.

Download and apply SAP Security Note 2934135 using the SAP Software Update Manager (SUM).

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, block external access to the vulnerable paths (/tc~lm~itsam~co~ui~flat~app~ear~web/ and /CTCWebService/) using a reverse proxy or SAP Web Dispatcher.

nginx

# Nginx Reverse Proxy Block Configuration
server {
    listen 80;
    server_name sap-java-app;

    # Block access to CTC Web Service and LM Configuration Wizard
    location ~* ^/(CTCWebService|tc~lm~itsam~co~ui~flat~app~ear~web) {
        deny all;
        return 403;
    }

    location / {
        proxy_pass http://sap_backend_java_upstream;
    }
}

3. Log Audit & IoC Verification Commands

Use the following Bash script to scan SAP NetWeaver HTTP access logs for unauthorized attempts to access the CTC Web Service.

bash

#!/bin/bash
# Define SAP NetWeaver HTTP Access Log Directory
LOG_DIR='/usr/sap/<SID>/<Instance>/j2ee/cluster/server0/log'

echo '[+] Scanning SAP NetWeaver Access Logs for CVE-2020-6287 indicators...'

# Search for CTCWebService calls returning 200 OK
if [ -d '$LOG_DIR' ]; then
    grep -r -i 'CTCWebService' '$LOG_DIR' | grep ' 200 ' > /tmp/suspicious_ctc_calls.log
    if [ -s /tmp/suspicious_ctc_calls.log ]; then
        echo '[!] WARNING: Suspicious CTC Web Service access detected!'
        cat /tmp/suspicious_ctc_calls.log
    else
        echo '[+] No suspicious CTC Web Service access found.'
    fi
else
    echo '[-] Log directory not found. Please check the path.'
fi

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

This vulnerability is actively exploited in the wild (CISA KEV); apply SAP Security Note 2934135 immediately to secure your environment.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability, widely known as 'RECON' (Remotely Exploitable Code Execution on NetWeaver), resides in the LM (Lifecycle Management) Configuration Wizard of SAP NetWeaver AS JAVA. The component includes the Central Technical Configuration (CTC) web application designed for initial system setup. The root cause is a Missing Authentication Check (CWE-306) within specific servlets and configuration task execution APIs, allowing unauthenticated requests to bypass security boundaries.

2. Exploitation Mechanics & Attack Scenario

An attacker can target the SAP NetWeaver Java HTTP/HTTPS port (default 5xx00) without any prior credentials. By sending crafted XML/SOAP requests to the exposed CTC servlets, the attacker can invoke internal APIs of the LM Configuration Wizard. A typical exploitation scenario involves:

Sending an unauthenticated request to the CTC servlet to trigger a task that creates a new SAP administrative user.
Logging into the SAP NetWeaver Administrator (NVA) console using the newly created credentials.
Executing arbitrary OS commands or deploying malicious Java archives (WAR/EAR) to achieve full Remote Code Execution (RCE).

3. Infrastructure & Business Impact

With a CVSS score of 10.0 and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability poses an extreme risk. Successful exploitation grants full administrative control over the SAP application server, enabling attackers to exfiltrate, modify, or delete critical business data (such as ERP, HR, and financial records). It also serves as a primary entry point for lateral movement within the corporate network.

Official Vendor Advisories & References

NVD Original English Description

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html

Source: cna@sap.com · Third Party Advisory, VDB Entry

http://seclists.org/fulldisclosure/2021/Apr/6

Source: cna@sap.com · Mailing List, Third Party Advisory

https://launchpad.support.sap.com/#/notes/2934135

Source: cna@sap.com · Permissions Required, Vendor Advisory

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675

Source: cna@sap.com · Broken Link, Vendor Advisory

https://www.onapsis.com/recon-sap-cyber-security-vulnerability

Source: cna@sap.com · Third Party Advisory

http://packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Task-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory, VDB Entry

Frequently Asked SecOps Questions (CVE-2020-6287)

FAQ

Q1. How critical is CVE-2020-6287 and is it actively exploited in the wild?

CVE-2020-6287 is rated CVSS 10.0 (CRITICAL). EPSS exploitation probability is pending FIRST.org calculation. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-6287?

Primary impacted vendors include sap across netweaver_as_java. Scope summary: SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30, 7.31, 7.40, and 7.50

Q3. What temporary mitigations or workarounds exist for CVE-2020-6287 before patching?

[Mitigation] Apply SAP Security Note 2934135 immediately or disable/restrict access to the CTC Web Service Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION