CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
Description
CVE-2010-5326 is a critical-severity missing authentication vulnerability in SAP NetWeaver Application Server Java. The Invoker Servlet in SAP NetWeaver does not require authentication, allowing remote attackers to execute arbitrary code via HTTP or HTTPS requests. Known as the "Detour" attack, this vulnerability was actively exploited in the wild from 2013 through 2016. CISA has listed it in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 16.90% (94.9th percentile), CVE-2010-5326 represents a severe remote code execution risk for unpatched SAP environments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver application server java | <= 7.30 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://service.sap.com/sap/support/notes/1445998(Permissions Required)
- http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions(Broken Link)
- http://www.securityfocus.com/bid/48925(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/90533(Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/ncas/alerts/TA16-132A(Third Party Advisory, US Government Resource)
- https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
Missing Authentication for Critical Function occurs when software does not perform any authentication for functionality that requires a provable user identity. In the case of SAP NetWeaver Application Server Java, the Invoker Servlet exposes critical server functionality without requiring any form of authentication, allowing unauthenticated remote attackers to execute arbitrary code on the server.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2010-5326 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL), indicating the most severe possible threat level. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any attacker with network access. The scope is changed, meaning exploitation can affect resources far beyond the vulnerable SAP NetWeaver component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, giving attackers full control over the affected system. The EPSS score of 16.90% (94.9th percentile) indicates a high probability of exploitation. Organizations running unpatched SAP NetWeaver Java Application Server face catastrophic risk, as attackers can achieve full remote code execution without any credentials.
Exploit Maturity
CVE-2010-5326 has been actively exploited in the wild from 2013 through 2016 in what is known as the "Detour" attack. CISA has confirmed active exploitation by including this vulnerability in the Known Exploited Vulnerabilities catalog. US-CERT issued alert TA16-132A specifically addressing exploitation of this SAP vulnerability. The EPSS score of 16.90% (94.9th percentile) indicates a high probability of continued exploitation activity. While no public exploit code is tagged in the NVD references, the well-documented attack methodology and years of active exploitation make this a highly actionable threat.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. SAP Security Note 1445998 addresses this vulnerability by disabling the Invoker Servlet.
- Upgrade all affected SAP NetWeaver Application Server Java instances (versions up to and including 7.30) to the latest patched versions that disable or remove the Invoker Servlet.
- If immediate patching is not possible, disable the Invoker Servlet manually by modifying the web.xml configuration to remove the servlet mapping, and restrict network access to the affected SAP application server using firewall rules.
- Implement authentication requirements for all administrative and critical servlets on the SAP NetWeaver platform, and audit the server configuration for any other unauthenticated endpoints.
- Review access logs for evidence of exploitation, particularly looking for direct HTTP/HTTPS requests to the Invoker Servlet endpoint, and conduct a thorough incident response investigation given the long history of active exploitation.
Technical Details
CVE-2010-5326 affects the Invoker Servlet in SAP NetWeaver Application Server Java platforms, possibly versions before 7.3. The vulnerability stems from a complete absence of authentication on the Invoker Servlet, which is a critical server component capable of executing arbitrary code. The attack vector is network-based with low complexity (CVSS vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning any attacker with HTTP or HTTPS access to the server can exploit it without credentials or user interaction. The changed scope and maximum confidentiality, integrity, and availability impact reflect the fact that successful exploitation grants full control over the SAP system and potentially connected resources. This vulnerability class, missing authentication for critical functions, is among the most dangerous as it eliminates the primary security boundary entirely.
Frequently Asked Questions
Is CVE-2010-5326 being actively exploited?
Yes. CVE-2010-5326 has been actively exploited in the wild since at least 2013, in what is known as the "Detour" attack against SAP systems. CISA has listed it in the Known Exploited Vulnerabilities catalog, and US-CERT issued a dedicated alert (TA16-132A) about its exploitation.
What products are affected by CVE-2010-5326?
CVE-2010-5326 affects SAP NetWeaver Application Server Java platforms, specifically versions up to and including 7.30. Any SAP NetWeaver Java environment with the Invoker Servlet enabled and accessible is vulnerable.
How do I fix CVE-2010-5326?
Apply updates per SAP vendor instructions, specifically SAP Security Note 1445998. Upgrade all affected SAP NetWeaver Java instances to patched versions. If immediate patching is not possible, disable the Invoker Servlet and restrict network access to the application server.
How severe is CVE-2010-5326?
CVE-2010-5326 has the maximum CVSS 3.1 score of 10.0 (CRITICAL). It allows unauthenticated remote code execution with no user interaction required. The EPSS score of 16.90% (94.9th percentile) and years of documented active exploitation make this an extremely high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.