In May 2021, SAP released critical security patches addressing high-priority vulnerabilities across SAP NetWeaver AS ABAP, SAP Business One, and SAP Process Integration. These updates resolve significant risks including code injection, OS command injection, and information disclosure, requiring immediate action from security teams to prevent system compromise.
What were the key SAP security updates in May 2021?
The May 2021 security release focused on mitigating risks that could allow unauthorized code execution and data exposure:
- SAP NetWeaver AS ABAP (Note 3046610): Patches a high-priority code injection vulnerability in program
RDDPUTJR. Attackers could exploit this to inject malicious code. The patch replaces the report code with an exit statement or allows for the program’s deletion via support packages. - SAP Business One (Notes 3049755 and 3049661): Addresses multiple high-risk vulnerabilities, including code injection, OS command injection, and information disclosure.
- SAP Process Integration (Notes 3012021 and 2745860): Resolves vulnerabilities in the Integration Builder Framework, specifically patching XML injection, information disclosure, and unrestricted file upload flaws.
How can I mitigate the NetWeaver AS ABAP code injection risk?
The code injection vulnerability in program RDDPUTJR (Note 3046610) is a high-priority threat. To mitigate this risk:
- Apply the Patch: Install the support packages provided in the note, which include the fix to replace the vulnerable report code or allow for its deletion.
- Restrict Access: As a temporary workaround, restrict access to transactions SA38 and SE38 to prevent unauthorized execution of the vulnerable report.
Summary of May 2021 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3046610 | NetWeaver AS ABAP | Code Injection | High Priority |
| 3049755 / 3049661 | SAP Business One | Code/OS Command Injection | System Compromise |
| 3012021 / 2745860 | Process Integration | XML Injection / File Upload | Data Exposure |
Frequently Asked Questions
What is the risk associated with the code injection in SAP NetWeaver?
The vulnerability in program RDDPUTJR allows attackers to inject malicious code into the system. Given that this is a high-priority issue, it could lead to full system compromise if exploited by an attacker with sufficient access rights.
Why is the Integration Builder Framework vulnerability significant?
Vulnerabilities in the Integration Builder Framework, such as XML injection and unrestricted file uploads, are severe because they target the middleware used to connect critical SAP systems. Exploiting these flaws could allow attackers to bypass security controls and expose sensitive business data.
Can I use a workaround for the NetWeaver code injection if I cannot patch?
Yes, you can mitigate the immediate risk by restricting access to transactions SA38 and SE38. This limits the ability of unauthorized users to execute the vulnerable report until the official support packages can be applied.