The March 2021 SAP Security Notes address three critical vulnerabilities, including a code injection flaw in SAP Manufacturing Integration and Intelligence (MII), an authorization check failure in SAP NetWeaver AS Java, and an authentication bypass in SAP HANA installations configured with LDAP services.
In March 2021, SAP released security patches to address significant vulnerabilities across its software portfolio. These advisories focus on critical risks that could allow unauthorized access, code execution, or authentication bypasses. Organizations running SAP environments should review these notes immediately to determine if their systems are impacted and apply the necessary patches or workarounds to maintain their security posture. This summary outlines the core vulnerabilities, the potential impact, and the recommended solutions provided by SAP.
Key Takeaways
- SAP MII: A code injection vulnerability allows attackers to execute malicious JSP code and OS commands.
- SAP NetWeaver: A missing authorization check in MigrationService could grant unauthorized administrative privileges.
- SAP HANA: An authentication bypass exists in systems using LDAP with unauthenticated binds enabled.
- Action Required: Review the specific security notes and apply patches or workarounds to mitigate these risks.
What is the vulnerability in SAP Manufacturing Integration and Intelligence (MII)?
The critical code injection vulnerability in SAP MII, addressed by note 3022622, stems from the Self Service Composition Environment (SSCE). SAP MII allows users to create dashboards and save them as JSP files through this environment. Attackers can exploit this feature to inject malicious JSP code containing OS commands, which are then executed by the system when the dashboard is opened by a user. The solution provided by SAP disables the ability to save files as JSP through the SSCE. There is no workaround for this vulnerability.
How can I mitigate the authorization check failure in SAP NetWeaver AS Java?
The vulnerability in the MigrationService of the SAP NetWeaver Application Server Java (AS Java), covered by note 3022422, involves a missing authorization check that could provide unauthorized access to configuration objects, including those that grant administrative privileges. The primary solution requires a system restart. If a system restart is not immediately feasible, administrators can apply the workaround detailed in note 3030298.
What is the risk to SAP HANA installations using LDAP?
SAP HANA installations using external authentication via LDAP directory services are susceptible to an authentication bypass vulnerability, as addressed in note 3017378. These systems are vulnerable if the connected LDAP directory server is configured to allow unauthenticated binds. In such cases, the SAP HANA database’s handling of LDAP authentication can be misused, allowing an attacker to gain access to the database system without proper authentication through users enabled for LDAP-based authentication.
Summary of March 2021 SAP Security Advisories
The following table summarizes the key details of the vulnerabilities addressed in the March 2021 security notes.
| SAP Component | Vulnerability Type | Priority | Solution |
|---|---|---|---|
| SAP MII | Code Injection | Hot News | Patch (Note 3022622) |
| SAP NetWeaver AS Java | Missing Authorization | Hot News | Patch or Workaround |
| SAP HANA | Authentication Bypass | High | Configuration Change |
Frequently Asked Questions
Are there workarounds for the SAP MII code injection vulnerability?
No, there is no workaround for the vulnerability in SAP MII. The only solution is to apply the patch provided in SAP Security Note 3022622, which blocks the ability to save files as JSP through the SSCE.
What is the recommended solution for the SAP NetWeaver MigrationService issue?
The recommended solution for the missing authorization check in SAP NetWeaver AS Java is to apply the patch provided in note 3022422, which requires a system restart. If a restart is not possible, you may apply the workaround in note 3030298.
When are SAP HANA systems vulnerable to the LDAP authentication bypass?
SAP HANA systems are only vulnerable if they are configured to use LDAP directory services for external authentication AND the connected LDAP directory server is enabled for unauthenticated binds.