The April 2020 SAP security updates address several critical and high-risk vulnerabilities across the SAP ecosystem, including flaws in Business Objects, SAP Commerce, SAP Host Agent, and Knowledge Management. Administrators should prioritize applying these patches to prevent malicious code execution, unauthorized access, and potential privilege escalation.
Executive Summary
In April 2020, SAP released a series of security notes to mitigate significant vulnerabilities impacting various platforms. The most critical update concerns a deserialization vulnerability in the SAP Business Objects platform that could allow attackers to execute malicious code. Other major updates include patches for input validation issues in SAP Commerce, directory traversal flaws in Knowledge Management, and a privilege escalation vulnerability in the SAP Host Agent. Additionally, SAP introduced new switchable authorization checks for SAP Central Finance and SAP Leasing to strengthen access controls. Organizations using these SAP products are strongly advised to review the relevant security notes and apply the necessary patches or configuration changes immediately to secure their environments against potential exploitation.
Key Takeaways
- A critical deserialization vulnerability in SAP Business Objects could lead to malicious code execution.
- SAP Commerce REST XML APIs contained a significant input validation vulnerability.
- Knowledge Management updates fix a high-risk directory traversal flaw that could corrupt or delete server files.
- SAP Host Agent users must update to version 7.21 PL46 to prevent root-level privilege escalation.
- New switchable authorization checks are available for SAP Central Finance and SAP Leasing.
Which SAP products were impacted by April 2020 security notes?
The April 2020 security release impacted several core SAP platforms, requiring immediate attention from security administrators:
- SAP Business Objects: Addressed a critical deserialization vulnerability.
- SAP Commerce: Patched a significant input validation vulnerability in REST XML APIs.
- Knowledge Management: Fixed a high-risk directory traversal vulnerability.
- SAP Host Agent: Resolved a privilege escalation vulnerability in the Operation Framework.
- SAP Central Finance and SAP Leasing: Introduced new switchable authorization checks.
What is the risk associated with the SAP Business Objects vulnerability?
The vulnerability in the SAP Business Objects platform, detailed in note 2863731, is a critical deserialization flaw within the Crystal Reports .Net SDK WebForm Viewer. Attackers with basic authorization can exploit this vulnerability to perform malicious code execution, posing a severe threat to the platform’s integrity and security.
How do you secure the SAP Host Agent?
To prevent attackers from gaining root privileges over the underlying operating system, administrators must update the SAP Host Agent to at least version 7.21 PL46, as outlined in note 2902645. Instructions for performing this upgrade are provided in SAP note 1031096.
Summary of April 2020 SAP Security Notes
The following table summarizes the key security notes released in April 2020 and the components they impact.
| Component | Vulnerability Type | SAP Note |
|---|---|---|
| Business Objects | Deserialization | 2863731 |
| SAP Commerce | Input Validation | 2904480 |
| Knowledge Management | Directory Traversal | 2896682 |
| SAP Host Agent | Privilege Escalation | 2902645 |
| Central Finance/Leasing | Authorization Check | 2495144 / 2495462 |
Frequently Asked Questions
What are switchable authorization checks?
Switchable authorization checks are security controls that supplement existing S_RFC authorization checks for specific function modules. After applying the relevant security notes for SAP Central Finance and SAP Leasing, these checks must be manually activated using transaction SACF to take effect.
Does the SAP Commerce vulnerability affect web stores?
Yes, the input validation vulnerability in SAP Commerce REST XML APIs 2904480 could impact both the availability and the confidentiality of web stores built on the platform. Patching is recommended to maintain store security.
What is the risk of the Knowledge Management directory traversal flaw?
The directory traversal vulnerability in Knowledge Management 2896682 is classified as high risk. It could enable unauthorized attackers to overwrite, delete, or corrupt sensitive files stored on SAP servers, potentially leading to significant system instability or data loss.