Hello Team,
I found two (redapi.acronis.com andredapi2.acronis.com) sap Netweaver vulnerable services. They do not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity, and Availability of the system, leading to Missing Authentication Check.
Just for the POC, I have created a random user with creds
sapRpoc9049:Secure!PwD6751 (at redapi.acronis.com)
{F1195413}
https://github.com/chipik/SAP_RECON
https://nvd.nist.gov/vuln/detail/CVE-2020-6286
https://nvd.nist.gov/vuln/detail/CVE-2020-6287
https://launchpad.support.sap.com/#/notes/2934135
https://launchpad.support.sap.com/#/notes/2939665
Please lemme know if you need any additional information reagarding this
This version of SAP netweaver does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity, and Availability of the system, leading to Missing Authentication Check.