In February 2022, SAP released several high-priority security updates, including new patches for the Log4Shell vulnerability and fixes for critical flaws in SAP Solution Manager and NetWeaver. These updates address risks ranging from remote code execution to SQL injection, necessitating prompt action from SAP security administrators.
What were the key SAP security updates in February 2022?
The February 2022 security release focused on mitigating critical vulnerabilities that could lead to system compromise:
- Log4Shell (Central Note 3131047): SAP updated the central advisory for the Apache Log4J 2 remote code execution vulnerability with notes 3142773 and 3139893, providing patches and manual procedures for SAP Commerce and SAP Dynamic Authorization Management.
- SAP Solution Manager (Note 3140940): Patches a code injection vulnerability caused by a lack of segregation of duties in Root Cause Analysis (RCA) tools. This flaw could allow users with admin privileges to browse files and execute code via connected Diagnostics Agents.
- SAP NetWeaver AS ABAP (Note 3140587): Addresses a high-risk SQL injection vulnerability in the Workplace Server.
- SAP NetWeaver AS Java (Note 3123427): Resolves an HTTP Request Smuggling vulnerability.
How do I address the code injection risk in SAP Solution Manager?
The vulnerability in SAP Solution Manager (Note 3140940) arises because of insufficient segregation of duties in the RCA tools. To secure your environment:
- Download the latest version of
LM_SERVICEvia note 3145008 to apply the primary fix. - Follow the instructions in note 3137764 to remove links to the vulnerable applications.
Summary of February 2022 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3142773 / 3139893 | SAP Commerce / Dynamic Auth | Log4Shell (RCE) | Critical |
| 3140940 | SAP Solution Manager | Code Injection | Privilege Escalation |
| 3140587 | NetWeaver AS ABAP | SQL Injection | High Risk |
| 3123427 | NetWeaver AS Java | HTTP Request Smuggling | High Risk |
Frequently Asked Questions
What should administrators prioritize for Log4Shell?
Administrators should review the updated central note 3131047 and ensure that notes 3142773 and 3139893 are applied to SAP Commerce and SAP Dynamic Authorization Management environments. These updates provide the necessary patches and manual workarounds to mitigate the Log4Shell remote code execution risk.
Why is the SAP Solution Manager vulnerability considered high-risk?
The code injection vulnerability in Solution Manager allows users with admin privileges to browse system files and execute arbitrary code through Diagnostics Agents. This effectively grants an attacker the ability to escalate privileges and compromise the underlying operating system.
What is the risk of the SQL injection vulnerability in NetWeaver?
The SQL injection flaw in the Workplace Server of NetWeaver AS ABAP could allow an attacker to interfere with database queries, potentially leading to unauthorized data access or modification within the SAP environment.