Adobe and SAP: All Your Business Documents Belong To Us
Today, enterprise business application security research has a long vita with studies on various industry-specific products, custom protocols, as well as platform technologies. Surprisingly, however, the most fundamental instrument companies across all sectors count on has been ignored so far: the paperwork. It is not a secret that electronic documents are omnipresent and with the majority of Fortune 500 companies running their businesses on SAP software systems, there is one key pillar catching our attention: SAP Adobe Document Services (ADS).
ADS is a solution extension developed by Adobe and SAP, which can be integrated with multiple SAP products, including S/4HANA. It is used to centrally process form-based data, produce digital and signed documents, as well as import or export the data from and to business systems. As mentioned by the German-speaking SAP user group (DSAG) in 2024, creating and printing documents is a business-critical need, with ADS still being relied upon by many companies out there [1]. Flying under the radar for far too long, it turns out that this component has even more noticeable characteristics, such as featuring connections to multiple satellite systems in the SAP landscape, hence potentially putting the entire infrastructure at risk when being compromised.
With this technical presentation, we will unmask the complexity of ADS and take you on a journey to making the world a safer place, while revealing a set of vulnerabilities identified by code reviews, network traffic and process analysis. Besides providing insights into SAP’s previously unexplored implementation of the Common Object Request Broker Architecture (CORBA), the results of our work showcase how threat actors could have taken full control of ADS to eavesdrop on confidential information and tamper documents in the enterprise world. We close the talk by providing the means to protect against the attacks discussed and have an outlook into the future of ADS.
[1] DSAG. Adobe Document Service. 2024. [Online]. Available: https://impulsant-dsag.de/formate/textbeitrag/dsag-positionspapier-adobe-document-service (German article)