Found multiple SAP NetWeaver vulnerable services

# Summary: Hello Team, I found two (**redapi.acronis.com** and **redapi2.acronis.com**) sap Netweaver vulnerable services. They do not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity, and Availability of the system, leading to Missing Authentication Check. # Steps To Reproduce: 1. Run the script {F1195428} 2. You will see random user created # POC: Just for the POC, I have created a random user with creds sapRpoc9049:Secure!PwD6751 (at redapi.acronis.com) {F1195413} # References: https://github.com/chipik/SAP_RECON https://nvd.nist.gov/vuln/detail/CVE-2020-6286 https://nvd.nist.gov/vuln/detail/CVE-2020-6287 https://launchpad.support.sap.com/#/notes/2934135 https://launchpad.support.sap.com/#/notes/2939665 **Please lemme know if you need any additional information reagarding this** ## Impact # Impact: This version of SAP netweaver does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity, and Availability of the system, leading to Missing Authentication Check.