Skip to content
Nuclei Templates

SAP NetWeaver ICM Info page leak

ID: sap-netweaver-info-leak

Severity: medium

Author: randomstr1ng

Tags: sap,misconfig

Description

Section titled “Description”

Detection of SAP NetWeaver ABAP Webserver /public/info page

YAML Source

Section titled “YAML Source”
id: sap-netweaver-info-leak


info:
  name: SAP NetWeaver ICM Info page leak
  author: randomstr1ng
  severity: medium
  description: Detection of SAP NetWeaver ABAP Webserver /public/info page
  reference:
    - https://www.acunetix.com/vulnerabilities/web/sap-icf-sap-public-info-sensitive-information-disclosure/
    - https://github.com/Jean-Francois-C/SAP-Security-Audit
  metadata:
    max-request: 1
    shodan-query: http.favicon.hash:-266008933
    product: content_server
    vendor: sap
    fofa-query: icon_hash=-266008933
  tags: sap,misconfig


http:
  - method: GET
    path:
      - "{{BaseURL}}/sap/public/info"


    matchers:
      - type: regex
        part: body
        regex:
          - "RFC_SYSTEM_INFO.Response"


    extractors:
      - type: regex
        part: body
        regex:
          - "<RFCDEST>.*</RFCDEST>"
# digest: 4b0a00483046022100a2cca5939ed03f4021cd2bcef3bb046fe453a20cbead4b85869508b1bf4f2c6c022100a6cf7b604b23339578e1ca56f50968dec72258cff12d52b4c91600947d2028e8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/misconfiguration/sap/sap-netweaver-info-leak.yaml"

View on Github