The January 2021 SAP Security Notes address several critical vulnerabilities, including code injection flaws in SAP Business Warehouse and a high-risk Denial of Service (DoS) vulnerability in SAP NetWeaver. These patches are essential for maintaining system integrity, preventing unauthorized command execution, and ensuring proper authorization checks across SAP environments.
Executive Summary
The January 2021 SAP security updates focus on mitigating high-risk vulnerabilities across key platforms, including SAP Business Warehouse (BW), SAP BW/4HANA, and SAP NetWeaver Application Server ABAP. Two “Hot News” notes resolve critical code injection vulnerabilities that could allow attackers to execute privileged operating system commands or inject malicious code via function modules. Additionally, the release addresses a high-risk Denial of Service (DoS) vulnerability that could lead to resource exhaustion by blocking the parallel execution of web-based demo examples. The update also includes a patch for a missing authorization check in RFC-enabled function modules, impacting both SAP NetWeaver and SAP S/4HANA. Organizations utilizing these SAP products should prioritize applying these patches to secure their systems against potential exploitation and unauthorized access.
Key Takeaways
- Code Injection: Critical patches address vulnerabilities in SAP Business Warehouse and SAP BW/4HANA that could allow privileged OS command execution.
- DoS Mitigation: A high-risk Denial of Service vulnerability in SAP NetWeaver is patched by restricting parallel execution of web-based demo examples.
- Authorization Flaws: Updates include a fix for a missing authorization check affecting RFC-enabled function modules in SAP NetWeaver and SAP S/4HANA.
- Patch Prioritization: Organizations should review these notes immediately to mitigate risks of code injection and system resource exhaustion.
Which SAP Security Notes were released in January 2021?
The January 2021 security release includes four primary notes addressing vulnerabilities in SAP Business Warehouse, BW/4HANA, and NetWeaver.
| SAP Security Note | Platform / Component | Vulnerability Type |
|---|---|---|
| 2983367 | SAP BW / SAP BW/4HANA | Code Injection |
| 2999854 | SAP BW / SAP BW/4HANA | Code Injection |
| 3000306 | SAP NetWeaver / ABAP Platform | Denial of Service (DoS) |
| 2993132 | SAP NetWeaver / SAP S/4HANA | Missing Authorization Check |
What are the critical code injection vulnerabilities?
The critical code injection vulnerabilities are addressed in notes 2983367 and 2999854. Note 2983367 impacts Master Data Management, where a flaw could be exploited to execute privileged OS commands; the patch introduces a hard-coded report name and removes the impacted function in BW/4HANA. Note 2999854 patches a similar vulnerability in SAP Business Warehouse by improving input validation to prevent the injection and execution of malicious code.
How does the January 2021 update address Denial of Service?
Note 3000306 addresses a high-risk Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP and the ABAP Platform. The patch prevents resource exhaustion by blocking the parallel execution of demo examples found in the web version of the ABAP Keyword Documentation.
FAQ
What should SAP administrators prioritize from the January 2021 notes?
Administrators should prioritize the “Hot News” notes 2983367 and 2999854, as these address critical code injection vulnerabilities that could allow for privileged command execution and malicious code injection.
Which platforms are affected by the missing authorization check?
The missing authorization check addressed in note 2993132 impacts RFC-enabled function modules within SAP NetWeaver AS ABAP and SAP S/4HANA.
Are these patches relevant to SAP BW/4HANA users?
Yes, SAP BW/4HANA users are specifically impacted by the code injection vulnerabilities addressed in notes 2983367 and 2999854.