CVE-2020-6287: SAP NetWeaver Auth Bypass Vulnerability

CVE-2020-6287 Overview

CVE-2020-6287, also known as RECON (Remotely Exploitable Code On NetWeaver), is a critical authentication bypass vulnerability affecting SAP NetWeaver Application Server Java. The vulnerability exists in the LM Configuration Wizard component, which fails to perform proper authentication checks, allowing unauthenticated remote attackers to execute configuration tasks and perform critical actions against the SAP Java system.

This vulnerability enables attackers to create administrative user accounts without any prior authentication, leading to complete system compromise with full impact on confidentiality, integrity, and availability. Given that SAP systems often process sensitive business data including financial records, customer information, and proprietary business logic, exploitation of this vulnerability can have devastating consequences for affected organizations.

Critical Impact

Unauthenticated remote attackers can create administrative accounts and gain full control over SAP NetWeaver AS JAVA systems, compromising all system data and functionality. This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.

Affected Products

• SAP NetWeaver Application Server Java 7.30
• SAP NetWeaver Application Server Java 7.31
• SAP NetWeaver Application Server Java 7.40
• SAP NetWeaver Application Server Java 7.50

Discovery Timeline

• 2020-07-14 - CVE-2020-6287 published to NVD
• 2025-10-31 - Last updated in NVD database

Technical Details for CVE-2020-6287

Vulnerability Analysis

CVE-2020-6287 represents a Missing Authentication Check vulnerability (CWE-306) in the SAP NetWeaver AS JAVA platform. The LM Configuration Wizard component, which is designed for initial system setup and configuration tasks, is exposed over HTTP without requiring authentication. This design flaw allows any network-accessible attacker to invoke privileged configuration functions that should only be available to authenticated administrators.

The vulnerability is particularly severe because it affects a core component of SAP's enterprise application infrastructure. SAP NetWeaver serves as the foundation for many critical SAP applications including SAP ERP, SAP S/4HANA, SAP SCM, SAP CRM, SAP PI/PO, SAP Solution Manager, and SAP Enterprise Portal. Successful exploitation grants attackers the ability to create new administrative users, modify existing configurations, and ultimately achieve persistent access to the compromised system.

Root Cause

The root cause of this vulnerability is an improper implementation of authentication controls within the LM Configuration Wizard component. The component exposes HTTP endpoints that process configuration requests without first verifying that the requesting user has been authenticated. This missing authentication check violates fundamental security principles and enables unauthenticated access to highly privileged functionality.

The LM Configuration Wizard was likely designed with the assumption that it would only be accessed during initial system setup in a controlled environment. However, the component remains accessible on production systems, and the lack of authentication checks creates a critical security gap that attackers can exploit remotely.

Attack Vector

The attack vector for CVE-2020-6287 is network-based, requiring no user interaction or prior authentication. An attacker with network access to the SAP NetWeaver AS JAVA HTTP service (typically accessible on ports 50000 or similar) can directly send malicious requests to the vulnerable LM Configuration Wizard endpoints.

The exploitation process involves sending specially crafted HTTP requests to the configuration wizard endpoints. These requests invoke privileged configuration tasks, with the most critical being the ability to create new administrative user accounts. Once an administrative account is created, the attacker has full control over the SAP system and can access, modify, or exfiltrate any data processed by the platform.

The vulnerability does not require any specific conditions to be met for exploitation—any exposed SAP NetWeaver AS JAVA instance running an affected version is vulnerable. This makes it an extremely attractive target for threat actors conducting opportunistic attacks or targeted intrusions against organizations using SAP infrastructure.

Detection Methods for CVE-2020-6287

Indicators of Compromise

• Unexpected HTTP requests to /CTCWebService/CTCWebServiceBean or /LMConfigurationWizard endpoints
• Creation of new administrative user accounts without corresponding authorized change requests
• Log entries indicating configuration wizard activity outside of scheduled maintenance windows
• Unusual authentication events from newly created accounts with administrative privileges

Detection Strategies

• Monitor HTTP access logs for requests to vulnerable LM Configuration Wizard endpoints
• Implement alerting on user creation events in SAP User Management Engine (UME), particularly for high-privilege accounts
• Deploy network intrusion detection signatures to identify exploitation attempts targeting CVE-2020-6287
• Review SAP Security Audit Log (SAL) for unauthorized configuration changes and user provisioning activities

Monitoring Recommendations

• Enable comprehensive HTTP access logging for SAP NetWeaver AS JAVA services
• Configure real-time alerting for any administrative user creation events
• Implement network segmentation monitoring to detect unauthorized access attempts to SAP infrastructure
• Establish baseline user account inventories and alert on deviations

How to Mitigate CVE-2020-6287

Immediate Actions Required

• Apply SAP Security Note 2934135 immediately to all affected SAP NetWeaver AS JAVA installations
• Audit all SAP systems for signs of compromise, including unauthorized user accounts and configuration changes
• Restrict network access to SAP NetWeaver AS JAVA HTTP interfaces using firewalls and access control lists
• Review and remove any suspicious administrative accounts that may have been created through exploitation

Patch Information

SAP has released Security Note 2934135 to address this vulnerability. Organizations should obtain the patch from the SAP Support Portal and apply it following SAP's recommended procedures. Given the critical severity and active exploitation of this vulnerability, patching should be treated as an emergency priority.

Additional guidance is available through the SAP Wiki Security Page. Organizations should also review the CISA Known Exploited Vulnerabilities entry for federal guidance and remediation deadlines.

Workarounds

• Implement network-level access controls to block external access to the LM Configuration Wizard endpoints
• Disable the LM Configuration Wizard component if it is not required for ongoing operations
• Deploy a Web Application Firewall (WAF) with rules to block requests to vulnerable endpoints
• Implement strict network segmentation to isolate SAP systems from untrusted networks

# Example: Block access to vulnerable endpoints using iptables
# Restrict access to SAP HTTP port from unauthorized networks
iptables -A INPUT -p tcp --dport 50000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP