Get the latest tech news
One Bug Wasn't Enough: Escalating Twice Through SAP's Setuid Landscape
Principal Security Engineer Tao Sauvage discovered two SAP flaws on a client project, resulting in a CVE and a custom tool.
In 2020, Vincent Berg published a blog post describing a vulnerability he found affecting an SAP setuid binary while preparing for a client project. I downloaded the SAP HANA Express VM and configured a local environment where I could more easily analyze and debug the binaries, without risking damage to the client's infrastructure. This kind of work (digging deep, getting lost in rabbit holes, solving puzzles, and building tools) is my favorite part of being a security engineer.
Or read this on Hacker News
