Collected research

Chained to hit: Discovering new vectors to gain remote and root access in SAP Enterprise Software

Pablo Artuso and Yvan Genuer · i.blackhat.com

Maps SAP's proprietary P4 protocol and reports 13 unauthenticated flaws in the JNDI services it exposes: SQL injection, arbitrary OS file read, blind SSRF with header injection and code execution in Solution Manager agent collectors, plus a JNDI reference injection in Enterprise Portal that needs no reverse connection.

Record

Researcher

Pablo Artuso and Yvan Genuer

Published by

i.blackhat.com

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2023 research round

Related sources

• Chained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software

Tags

• rce
• ssrf
• header-injection
• sqli
• command-injection
• privilege-escalation
• info-leak
• attack-chain
• java
• cve
• owasp-a01-2021
• owasp-a03-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Pablo Artuso and Yvan Genuer, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.