[TALK] 🇫🇷 There Is No Place To Run : Assessing SAP Focused Run Security

│║ SAP Focused Run is the brand new product in the SAP world. Introduced in │║ 2020 it is the replacement of the current well known SAP Solution Manager. │║ It is a dedicated type of SAP System to manage all others in the company │║ landscape. In other words, this new product will be the technical backbone │║ of many business applications for companies in years to come. │║ │║ The first part of this talk will describe our research process used to │║ understand how this new product works, and how we discovered several │║ vulnerabilities. Attendees will learn how weaknesses in connected systems │║ can be leveraged to compromise SAP Focused Run and then, compromise the │║ rest of the landscape. │║ │║ In the second part of the talk, five different vulnerabilities found by │║ Onapsis Research Lab on different SAP products will be shared and │║ presented, along with a complete attack scenario affecting SAP Focused │║ Run. We will speak about vulnerabilities like Insecure Deserialization, │║ XSLT Injection, Code injection and Missing Authentication. │║ │║ Finally, we will provide all recommendations and mitigation strategies ▄ │║ related to issues covered in this talk.

About Yvan Genuer

Yvan Genuer is a Sr. Security Researcher at Onapsis. He has over 17 years of SAP experience. He has been delivering consultancy services around SAP Security as well as researching for vulnerabilities into SAP products, resulting in SAP AG official acknowledgements he has received, for several vulnerabilities he originally reported. Furthermore, he has also conducted both trainings and talks about this topic in conferences.

fa-twitter: TWITTER