The September 2020 SAP security patch cycle addresses critical vulnerabilities, including a code injection flaw in SAP Business Warehouse, an authenticated attack vector in SAP Marketing, and an OS command injection vulnerability in NetWeaver AS ABAP. Organizations running these platforms should review the identified SAP Security Notes to prioritize patching.
The September 2020 SAP security bulletin highlights critical vulnerabilities requiring immediate attention. The most severe issue is a code injection vulnerability in SAP Business Warehouse (BW) on SAP Adaptive Server Enterprise (ASE) platforms, which could allow attackers to gain full control of the system. Additionally, SAP Marketing installations are at risk from authenticated attacks targeting the Mobile Channel Servlet, though an interim workaround is available. Other updates address OS command injection in NetWeaver AS ABAP, privilege escalation in SAP Landscape Management, and Server-Side Request Forgery (SSRF) in AS ABAP. Security teams should evaluate their specific environment against these notes to determine the urgency of their implementation.
Key Takeaways
- SAP Business Warehouse on SAP ASE (15.7 and 16.0) requires patching for a critical code injection vulnerability.
- SAP Marketing installations are vulnerable to authenticated attacks via the Mobile Channel Servlet.
- NetWeaver AS ABAP contains an OS command injection vulnerability in the batch input recorder report RSBDCREC.
- Updates are available for privilege escalation in SAP Landscape Management and SSRF in AS ABAP.
What are the critical SAP security notes for September 2020?
The September 2020 update cycle includes several patches for critical and high-severity vulnerabilities across various SAP platforms. The following table summarizes the key security notes released during this period.
| SAP Security Note | Vulnerability Type | Affected Component |
|---|---|---|
| 2958563 | Code Injection | SAP Business Warehouse (on SAP ASE) |
| 2961991 | Unauthorized Access | SAP Marketing (Mobile Channel Servlet) |
| 2941667 | OS Command Injection | NetWeaver AS ABAP (RSBDCREC report) |
| 2902456 | Privilege Escalation | SAP Landscape Management |
| 2912939 | SSRF | AS ABAP |
How do you address the SAP Business Warehouse vulnerability?
Note 2958563 patches a critical code injection vulnerability in SAP Business Warehouse. This vulnerability allows an attacker to assume complete control of the BW system—including viewing, changing, or deleting data—by injecting code into the working memory for execution. It specifically impacts BW releases up to 7.40 running on SAP Adaptive Server Enterprise (ASE) 15.7 and 16.0. Installations on other database platforms are not impacted.
What is the status of the SAP Marketing security patch?
Note 2961991 addresses a vulnerability in SAP Marketing by blocking authenticated attackers from invoking specific functions in the Mobile Channel Servlet. The patch functions by blocking unwanted URLs via web.xml and scanning payloads of /$batch requests. If this note cannot be implemented immediately, the workaround provided in note 2962970 serves as an interim solution.
Are there updates for NetWeaver AS ABAP and other components?
Yes, several other components received security updates in September 2020. Note 2941667 provides updated correction instructions for an OS command injection vulnerability in NetWeaver AS ABAP, specifically regarding the batch input recorder report RSBDCREC when executed outside of transaction SHDB. Additionally, notes 2902456 and 2912939 were updated to address privilege escalation in SAP Landscape Management and Server Side Request Forgery (SSRF) in AS ABAP, respectively.
FAQ
Which SAP Business Warehouse versions are affected by the critical code injection?
The vulnerability affects BW releases up to 7.40 that are running on SAP Adaptive Server Enterprise (ASE) versions 15.7 and 16.0. Installations using other database platforms are not affected.
What should I do if I cannot immediately apply the SAP Marketing patch?
If you cannot implement the primary fix in note 2961991, you should apply the workaround provided in note 2962970 as an interim measure.
What specific report is impacted by the OS command injection in NetWeaver AS ABAP?
The vulnerability impacts the batch input recorder report RSBDCREC, specifically when that report is executed outside the context of transaction SHDB.