CVE-2014-5171

Vulnerability

SAP HANA Extended Application Services (XS) fails to enforce encryption for form-based authentication when SSL is enabled for an application. This occurs because the login form and subsequent authentication traffic are transmitted in cleartext, even though the application itself is configured to use SSL. The vulnerability affects SAP HANA XS; specific releases are listed in SAP Note 1963932 [1][2].

Exploitation

To exploit, an attacker must be on the same network segment as the victim and able to sniff network traffic (e.g., via ARP spoofing or passive monitoring). The victim must use a form-based login page on an application deployed on SAP HANA XS that has SSL enabled. The attacker captures the unencrypted HTTP POST request containing the username and password [1][2].

Impact

Successful exploitation exposes the user's credentials (and potentially other sensitive data) to the attacker. With valid credentials, the attacker can then authenticate to the SAP HANA system and access or modify data according to the compromised user's privileges. The integrity and availability of the system are not directly affected by the sniffing itself, but the gained access may be used for further attacks [1][2].

Mitigation

SAP has released a security note (SAP Note 1963932) that addresses this issue. Administrators should apply the patch provided in this note to their SAP HANA systems. Alternatively, ensure that form-based authentication is only used over connections that enforce SSL (HTTPS) at all layers, or use other authentication methods that do not expose credentials in plaintext. No workaround beyond applying the official patch is documented [1][2].