id: sap-router-info-leak

info:
  name: SAPRouter - Routing information leak
  author: randomstr1ng
  severity: critical
  description: SAPRouter contains an information leakage vulnerability.
  reference:
    - https://securityforeveryone.com/tools/saprouter-routing-information-leakage-vulnerability-scanner
    - https://support.sap.com/en/tools/connectivity-tools/saprouter.html
  metadata:
    max-request: 1
  tags: network,sap,misconfig,saprouter,tcp,vuln

tcp:
  - inputs:
      - data: 00000022524f555445525f41444d002802000000000000000000000000000000000000000000
        type: hex

    host:
      - "{{Hostname}}"
    port: 3299
    read-size: 2048

    matchers:
      - type: word
        words:
          - "Routtab"
          - "Working directory"
          - "SAProuter Connection Table"
# digest: 4a0a00473045022100d1f31ede46d385de488b5720ad43e2018f6d8969e77093fc7d143f4d7824f89702201843d50484062a8ed8f2505399a908f4b5fd918aef6e2e93ee7b035b9b5c4c39:922c64590222798bb761d5b6d8e72950