CVE-2023-27497: SAP Diagnostics Agent RCE Vulnerability

CVE-2023-27497 Overview

CVE-2023-27497 affects the EventLogServiceCollector component of SAP Diagnostics Agent version 720 on Windows hosts. The component lacks authentication and fails to sanitize code input, allowing remote attackers to execute arbitrary scripts on every connected Diagnostics Agent. Successful exploitation compromises confidentiality, integrity, and availability of the targeted systems. SAP addressed the issue in SAP Note #3305369, published alongside SAP's April 2023 Security Patch Day.

Critical Impact
Unauthenticated network attackers can execute malicious scripts across all connected SAP Diagnostics Agents running on Windows, leading to full system compromise.

Affected Products

SAP Diagnostics Agent version 720
Microsoft Windows hosts running the affected agent
Connected SolMan landscapes that rely on the EventLogServiceCollector

Discovery Timeline

2023-04-11 - CVE-2023-27497 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-27497

Vulnerability Analysis

The SAP Diagnostics Agent acts as a data collector for SAP Solution Manager, gathering performance and event data from managed systems. The EventLogServiceCollector exposes a network-reachable interface that processes collector instructions on Windows endpoints. The component fails to verify caller identity and accepts script code without sanitization. An attacker who can reach the agent network port sends crafted collector payloads that the agent interprets and executes locally. Because the agent typically runs with elevated service privileges, the attacker gains arbitrary code execution at that privilege level. The flaw is classified under [CWE-306] Missing Authentication for Critical Function.

Root Cause

Two defects combine to produce the vulnerability. First, the EventLogServiceCollector does not enforce authentication on incoming requests. Second, the collector passes attacker-controlled input into a script execution context without input validation. Either defect alone would be serious, but together they permit unauthenticated remote code execution.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker with reachability to the Diagnostics Agent's listening port submits a malicious script through the unauthenticated collector interface. The agent executes the script on the underlying Windows host. From a single compromised SolMan environment, the attacker can pivot to every connected Diagnostics Agent in the landscape.

No public proof-of-concept code is referenced in the advisory. Technical details are restricted to the SAP Note #3305369 accessible to SAP customers.

Detection Methods for CVE-2023-27497

Indicators of Compromise

Unexpected child processes spawned by the SAP Diagnostics Agent service (SAPDiagnosticsAgent) such as cmd.exe, powershell.exe, or wscript.exe
New or modified files in the Diagnostics Agent working directories created outside scheduled collection windows
Outbound network connections from the agent host to non-SolMan infrastructure
Anomalous script execution events logged on Windows hosts running the agent

Detection Strategies

Inventory all hosts running SAP Diagnostics Agent 720 and confirm patch status against SAP Note #3305369
Audit network access controls to verify only authorized SolMan servers can reach Diagnostics Agent ports
Hunt for process lineage where the Diagnostics Agent service is the parent of interactive shells or interpreters
Correlate Windows Event Log script execution events with SAP collector activity timestamps

Monitoring Recommendations

Enable PowerShell script block logging and Sysmon process creation events on agent hosts
Forward agent host telemetry to a central data lake for cross-host correlation
Alert on any execution of unsigned scripts originating from SAP service accounts
Monitor for unauthorized configuration changes to EventLogServiceCollector parameters

How to Mitigate CVE-2023-27497

Immediate Actions Required

Apply the patch referenced in SAP Note #3305369 to all SAP Diagnostics Agent 720 installations on Windows
Restrict network access to Diagnostics Agent ports so only authorized SAP Solution Manager hosts can connect
Review service account privileges and reduce them where the agent runs with unnecessary rights
Audit recent agent activity for signs of prior exploitation before applying the patch

Patch Information

SAP released the fix as part of the April 2023 Security Patch Day. Customers should apply SAP Note #3305369 via the SAP Support Portal. The patch adds authentication to the EventLogServiceCollector interface and sanitizes collector input. SAP's general guidance is documented in the SAP Security Guidance document.

Workarounds

Place Diagnostics Agent hosts on a segmented management VLAN reachable only from SolMan
Use host-based firewall rules to allow inbound collector traffic exclusively from the SolMan server IP
Disable the Diagnostics Agent service on hosts where it is not actively required until patching is complete

bash

# Example Windows firewall rule restricting Diagnostics Agent access to the SolMan server
New-NetFirewallRule -DisplayName "SAP Diagnostics Agent - SolMan Only" `
  -Direction Inbound `
  -Program "C:\usr\sap\DAA\SMDA*\exe\smdagent.exe" `
  -RemoteAddress <SolMan_Server_IP> `
  -Action Allow