In August 2021, SAP released critical security updates addressing high-priority vulnerabilities across SAP NetWeaver, SAP S/4HANA, and SAP Business One. These patches resolve severe risks, including Server-Side Request Forgery (SSRF), SQL injection, and authentication bypasses, which could potentially lead to full system compromise if left unaddressed.
What were the key SAP security updates in August 2021?
The August 2021 security release focused on hardening critical infrastructure components:
- SAP NetWeaver Development Infrastructure (NWDI): Note 3072955 patches a critical Server-Side Request Forgery (SSRF) vulnerability in the Component Build Service. With a CVSS score of 9.9/10, this flaw poses an extreme risk for internet-exposed systems.
- SAP S/4HANA & DMIS Plug-In: Note 3078312 addresses a blind SQL injection vulnerability in function module
IUUCRECONRCCOUNTTABLEBIG. The patch enforces an emptyITWHERE_CLAUSEparameter to prevent malicious query execution. - SAP Web Dispatcher & HANA: Note 3057378 patches a high-risk missing authentication vulnerability affecting X.509 client certificate usage, impacting both standalone Web Dispatchers and embedded versions in SAP HANA/HANA XS.
- SAP Business One: Note 3071984 provides an updated workaround for an unrestricted file upload vulnerability that could be exploited to upload malicious scripts.
How to mitigate the NWDI SSRF vulnerability
The SSRF vulnerability in the NWDI Component Build Service (Note 3072955) is particularly severe for internet-facing installations. The patch removes the vulnerable servlet from the productive code. Administrators are urged to apply this update immediately to eliminate the proxy attack vector.
Summary of August 2021 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3072955 | NWDI Component Build Service | SSRF | Critical (CVSS 9.9) |
| 3078312 | DMIS Plug-In / S/4HANA | Blind SQL Injection | Data Access |
| 3057378 | Web Dispatcher / HANA | Missing Authentication | Unauthorized Access |
| 3071984 | SAP Business One | Unrestricted File Upload | Malicious Scripting |
Frequently Asked Questions
Why is the NWDI SSRF vulnerability rated 9.9/10?
The SSRF vulnerability in the Component Build Service allows attackers to perform proxy attacks against internal infrastructure. Because it is highly exploitable in internet-facing installations, it presents an near-maximal risk to the organization’s network security.
Does the SQL injection fix in S/4HANA affect business operations?
The patch for note 3078312 enforces an empty ITWHERECLAUSE parameter. Since the affected function module is used exclusively by SAP for internal reconciliation, this change is not expected to impact standard customer business processes or product functionality.
What is the risk of the missing authentication in SAP Web Dispatcher?
The vulnerability patched by note 3057378 allows an attacker to bypass authentication when using X.509 client certificates. This could lead to unauthorized access to the system, making it a high-risk issue for any environment relying on certificate-based authentication.