In December 2022, SAP released critical security patches for vulnerabilities affecting SAP NetWeaver Application Server Java, SAP BusinessObjects, and SAP Commerce. These vulnerabilities include broken authentication, server-side request forgery, and remote code execution, requiring urgent implementation of security notes 3267780, 3273480, 3239475, and 3271523 to protect systems from exploitation.
The December 2022 security updates addressed significant risks across multiple SAP platforms. SAP NetWeaver AS Java faced broken authentication flaws (notes 3267780 and 3273480) that allowed unauthorized access to interfaces via JNDI. SAP BusinessObjects (BOBJ) 4.2 and 4.3 were impacted by a critical server-side request forgery (SSRF) vulnerability (note 3239475) that could lead to full system compromise. Additionally, SAP Commerce was susceptible to remote code execution due to an outdated Apache Commons Text library (note 3271523). Implementing these patches is essential, as some vulnerabilities, such as those in NetWeaver, currently have no workarounds.
Key Takeaways
- Implement notes 3267780 and 3273480 to patch broken authentication vulnerabilities in SAP NetWeaver AS Java.
- Apply note 3239475 to address a critical SSRF vulnerability in SAP BusinessObjects 4.2 and 4.3.
- Update Apache Commons Text to version 1.10 in SAP Commerce to mitigate remote code execution risks (note 3271523).
- Restrict interface access in SAP NetWeaver AS Java using specific UME roles like SAPXIADMINISTRATOR_J2EE.
What are the critical vulnerabilities in SAP NetWeaver AS Java?
SAP NetWeaver Application Server Java (AS Java) is affected by broken authentication vulnerabilities patched in notes 3267780 and 3273480. Threat actors can exploit these to attach to an open interface exposed through JNDI by the Messaging System and User Defined Search (UDS). Once attached, attackers can access services, read or modify sensitive information, execute SQL commands, and perform a denial of service. There are no workarounds for these vulnerabilities.
After implementing these corrections, administrators must apply access control for the interface. The following table outlines the required User Management Engine (UME) roles for access:
| Access Level | Required UME Role |
|---|---|
| Full Access | SAPXIADMINISTRATORJ2EE |
| Read and Write Access | SAPXICONFIGURATORJ2EE and SAPXIDEVELOPERJ2EE |
| Read-only Access | NWAREADONLY |
How to mitigate the SSRF vulnerability in SAP BusinessObjects?
Note 3239475 addresses a critical Server-Side Request Forgery (SSRF) vulnerability in the SAP BusinessObjects Business Intelligence Platform (BOBJ). This vulnerability enables attackers with non-administrative privileges to upload or replace any file on the operating system of the Business Objects server, effectively granting them full control of the system. Both the Central Management Console (CMC) and BI Launchpad (BILP) on BOBJ 4.2 and 4.3 are impacted.
How to address remote code execution in SAP Commerce?
SAP Commerce is affected by a remote code execution vulnerability associated with Apache Commons Text, an open-source Java library used for variable interpolation, as detailed in note 3271523. Versions 1.5 – 1.9 of Apache Commons Text include interpolators that can be used to execute arbitrary code or connect with remote servers. To resolve this, the library should be updated to version 1.10 to disable the vulnerable interpolators. Note 3271523 provides specific instructions for locating and updating the affected .jar files manually.
Frequently Asked Questions
What SAP platforms were impacted by the December 2022 security notes?
The December 2022 security notes addressed vulnerabilities in SAP NetWeaver Application Server Java, SAP BusinessObjects Business Intelligence Platform (BOBJ) versions 4.2 and 4.3, and SAP Commerce.
Are there workarounds for the SAP NetWeaver AS Java vulnerabilities?
No, there are no workarounds for the broken authentication vulnerabilities in SAP NetWeaver AS Java. Organizations must implement the security notes 3267780 and 3273480 and configure the necessary UME roles to secure the interfaces.
How do I patch the remote code execution vulnerability in SAP Commerce?
To patch the vulnerability in SAP Commerce, you must update the Apache Commons Text library to version 1.10. This disables the vulnerable interpolators found in versions 1.5 through 1.9. Detailed instructions for manually updating the .jar files are provided in note 3271523.