Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "NetWeaver ABAP / SAP_BASIS",
          "vendor": "Sap",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Moritz Bechler via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-004\nProduct:                   SAP NetWeaver ABAP / SAP_BASIS\nManufacturer:              SAP SE\nAffected Version(s):       SAP_BASIS 700 - 918\nTested Version(s):         7.93 Patch 300\nVulnerability Type:        CWE-347: Improper Verification of Cryptographic Signature\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2025-11-06\nSolution Date:             2026-02-10\nPublic Disclosure:         2026-06-08\nCVE Reference:             CVE-2026-23687\nAuthor of Advisory:        Moritz Bechler, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nSAP NetWeaver is the software stack powering SAP\u0027s business applications,\nincluding S4/HANA.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"SAP NetWeaver provides an open integration and application platform and\nfacilitates the implementation of the Enterprise Services Architecture.\nYou can standardize business processes across technological boundaries,\nintegrate applications for your employees as required, and access and edit\nsimple information easily and in a structured manner.\n[...]\nSAP NetWeaver is the basis for SAP solutions.\"\n\nSAML response validation in NetWeaver\u0027s SAML Service Provider is susceptible\nto XML Signature wrapping attacks, specifically through Signature/Object tags.\nThis allows an attacker to manipulate SAML assertion data returned by the\nidentity provider, therefore enabling logging in as an arbitrary user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nIn SAML authentication responses, the SAML assertion/user identity attributes\nare cryptographically signed by the identity provider using the XML Signature\n(XMLDSig) standard. In web single sign-on contexts, the SAML response is\npassed through the authenticating user\u0027s browser and therefore very susceptible\nto modification.\n\nWhen verifying a specially crafted SAML response, the SAMP service provider\nimplementation verifies the signature over one part of the XML document while\nusing information from another element to identify the authenticated user.\n\nProviding original, legitimate information from any valid SAML response in\nthe first part and the corresponding signature, along with a manipulated\nalternative part, authentication to the SAP system as an arbitrary\nSAML-enabled / mapped user is possible.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nA typical (non-encrypted, assertion signing) SAML response will have a structure\nlike the following (various irrelevant elements are removed for brevity):\n\n\u003csamlp:Response\u003e\n\u003cAssertion ID=\"MyID\"\u003e\n  \u003cSignature\u003e\n    \u003cSignedInfo\u003e\n      \u003cReference URI=\"#MyID\"\u003e\n         \u003cDigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"; /\u003e\n         \u003cDigestValue\u003e[...]\u003c/DigestValue\u003e\n      \u003c/Reference\u003e\n    \u003c/SignedInfo\u003e\n    \u003cSignatureValue\u003e[...]\u003c/SignatureValue\u003e\n    \u003cKeyInfo\u003e\n       \u003cX509Data\u003e\u003cX509Certificate\u003e[...]\u003c/X509Certificate\u003e\u003c/X509Data\u003e\n    \u003c/KeyInfo\u003e\n  \u003c/Signature\u003e\n  \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n  \u003cAttributeStatement\u003e\n    \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n      \u003cAttributeValue\u003eoriginaluser@mydomain.example\u003c/AttributeValue\u003e\n    \u003c/Attribute\u003e\n    \u003c...\u003e\n  \u003c/AttributeStatement\u003e\n\u003c/Assertion\u003e\n\u003c/samlp:Response\u003e\n\nThe XML Signature specification is very flexible (read: complex), leaving\nsignificant room for ambiguities and implementation errors. Apart from\nreferencing the data to be signed/verified through the \u003cReference\u003e element,\nthe signed data can also be directly included in the \u003cSignature\u003e element\nthrough an \u003cObject\u003e tag (see [4]).\nDoing so is fully specified and conformant with the XML schema.\n\nTransforming the SAML response to use the \u003cObject\u003e syntax yields the following:\n\n\u003csamlp:Response\u003e\n\u003cAssertion ID=\"MyID\"\u003e\n  \u003cSignature\u003e\n    \u003cSignedInfo\u003e\n      \u003cReference URI=\"#MyID\"\u003e\n         \u003cDigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"; /\u003e\n         \u003cDigestValue\u003e[...]\u003c/DigestValue\u003e\n      \u003c/Reference\u003e\n    \u003c/SignedInfo\u003e\n    \u003cSignatureValue\u003e[...]\u003c/SignatureValue\u003e\n    \u003cKeyInfo\u003e\n       \u003cX509Data\u003e\u003cX509Certificate\u003e[...]\u003c/X509Certificate\u003e\u003c/X509Data\u003e\n    \u003c/KeyInfo\u003e\n    \u003cObject\u003e\n      \u003cAssertion ID=\"MyID\"\u003e\n        \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n        \u003cAttributeStatement\u003e\n          \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n            \u003cAttributeValue\u003eoriginaluser@mydomain.example\u003c/AttributeValue\u003e\n          \u003c/Attribute\u003e\n          \u003c...\u003e\n        \u003c/AttributeStatement\u003e\n      \u003c/Assertion\u003e\n    \u003c/Object\u003e\n  \u003c/Signature\u003e\n  \u003cSubject\u003e\u003c...\u003e\u003c/Subject\u003e\n  \u003cAttributeStatement\u003e\n    \u003cAttribute Name=\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\";\u003e\n      \u003cAttributeValue\u003emyadmin@mydomain.example\u003c/AttributeValue\u003e\n    \u003c/Attribute\u003e\n    \u003c...\u003e\n  \u003c/AttributeStatement\u003e\n\u003c/Assertion\u003e\n\u003c/samlp:Response\u003e\n\nThis is a well-known and published attack vector against XML signatures.\nA graphical representation of this transformation is given in [5], also\nthe Burp SAML Raider extension provides a convenient way to execute the\nattack (XSW8).\n\nAs the signed elements have not changed, the XML Signature element is still\nvalid and can be verified. The XML Signature implementation used in NetWeaver\nnow calculates the hash value for verification of the signature over the\n\u003cObject\u003e element\u0027s contents.\n\nNow, the original copy of the data within the outer \u003cAssertion\u003e element\ncan be modified without invalidating the signature, and this is the\ninformation extracted and used by NetWeaver to determine the identity of\nthe authenticated SAP user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nApply vendor patch: SAP note 3697567.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-10-23: Vulnerability discovered\n2025-11-06: Vulnerability reported to vendor\n2025-11-10: Vendor unable to reproduce the vulnerability, requesting\n            additional diagnostics\n2025-12-10: Reproduction with assistance of a generous customer\n2025-12-12: Diagnostics provided to vendor\n2025-12-18: Vendor responded to diagnostics with: \"system reaction is as\n            expected, no security issue\"\n2025-12-18: Disputed this assessment\n2026-01-08: Requested status from vendor\n2026-01-08: Vendor confirmed vulnerability\n2026-02-10: Vendor released patch\n2026-06-08: Public disclosure of vulnerability (delayed on vendor\u0027s request)\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] SAP NetWeaver documentation\n    https://help.sap.com/doc/saphelp_em900/9.0/en-US/ca/6fbd35746dbd2de10000009b38f889/frameset.htm\n[2] SySS Security Advisory SYSS-2026-004\n    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-004.txt\n[3] SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] XML Signature Syntax and Processing Version 1.1\n    https://www.w3.org/TR/xmldsig-core1/#sec-Object\n[5] Burp SAML Raider extension documentation, tree representation of signature\n    wrapping techniques\n    https://github.com/CompassSecurity/SAMLRaider/blob/master/src/main/resources/xswlist.png\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Moritz Bechler of SySS GmbH.\n\nE-Mail: moritz.bechler () syss de\nPublic Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc\nKey ID: 0x768EFE2BB3E53DDA\nKey Fingerprint: 2C8F F101 9D77 BDE6 465E  CCC2 768E FE2B B3E5 3DDA\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:29:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/1"
        },
        {
          "url": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\""
        },
        {
          "url": "http://www.w3.org/2001/04/xmlenc#sha256\""
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://github.com/CompassSecurity/SAMLRaider/blob/master/src/main/resources/xswlist.png"
        },
        {
          "url": "https://help.sap.com/doc/saphelp_em900/9.0/en-US/ca/6fbd35746dbd2de10000009b38f889/frameset.htm"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/PGPKeys/Moritz_Bechler.asc"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-004.txt"
        },
        {
          "url": "https://www.w3.org/TR/xmldsig-core1/#sec-Object"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-004] SAP NetWeaver SAML XML Signature Wrapping",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-23687",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0349",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/1",
            "automated": true,
            "contentSha256": "33de3a1df73ad7824fff3086de79442bc32d33c5171db97ebc23d02afe7353b4",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-08T08:16:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0349"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T11:29:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0349"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}