In April 2021, SAP released critical security updates addressing high-priority vulnerabilities across SAP Business Warehouse (BW), SAP Commerce, and SAP NetWeaver AS Java. These patches resolve severe risks, including remote code injection, privilege escalation, and information disclosure, requiring immediate attention from security administrators to maintain system integrity.
What were the key SAP security updates in April 2021?
The April 2021 security release focused on mitigating risks associated with code execution and unauthorized system access:
- SAP Business Warehouse (Note 2999854): Patches a critical code injection vulnerability. Low-privileged attackers with RFC access could inject malicious ABAP code into reports, potentially leading to data loss or denial of service.
- SAP Commerce (Note 3040210): Resolves a remote code injection vulnerability in the Source Rules of the Backoffice application. Attackers could inject malicious code into rules, leading to remote code execution (RCE).
- SAP NetWeaver AS Java (Note 3022422): Addresses a missing authorization check in the MigrationService that could allow attackers to escalate privileges by accessing specific configuration objects.
- SAP NetWeaver AS Java (Note 3001824): Patches an information disclosure vulnerability that could allow attackers to access sensitive NTLM hashes via telnet commands.
How to mitigate the SAP Business Warehouse vulnerability
The code injection vulnerability in SAP BW (Note 2999854) allows low-privileged users to inject persistent ABAP code into the repository. To remediate this:
- Apply the Patch: The note introduces necessary input validation for the affected function modules.
- Restrict Access: As a temporary workaround, audit and restrict RFC access to the specific function modules identified in the note.
Summary of April 2021 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 2999854 | SAP BW / BW/4HANA | Code Injection | Critical |
| 3040210 | SAP Commerce | Remote Code Execution | High Priority |
| 3022422 | NetWeaver AS Java | Missing Authorization | Privilege Escalation |
| 3001824 | NetWeaver AS Java | Information Disclosure | Credential Leakage |
Frequently Asked Questions
Why is the SAP BW code injection vulnerability considered critical?
The vulnerability allows low-privileged attackers to inject malicious ABAP code that is saved persistently in the repository. This code can later be executed, leading to the modification or loss of sensitive business data or a complete system denial of service.
What is the risk associated with the SAP Commerce Source Rules?
Authorized users in the Backoffice application could inject malicious code into source rules. Once published, this code could be executed, allowing an attacker to compromise the confidentiality, integrity, and availability of the entire SAP Commerce application.
How can I mitigate the information disclosure risk in AS Java?
Note 3001824 identifies that NTLM hashes can be accessed via telnet. Recommended workarounds include disabling outgoing NTLM traffic via group policy, blocking outgoing SMB requests using firewall rules, or disabling the Samba protocol on affected host clusters.