In January 2022, SAP released multiple high-priority security updates, continuing the industry-wide response to the Log4Shell vulnerability and addressing significant security flaws in S/4HANA and NetWeaver Application Server ABAP. These patches are essential for mitigating risks related to remote code execution, malicious file uploads, and unauthorized system access.
What were the key SAP security updates in January 2022?
The January 2022 security release focused on patching critical vulnerabilities across several SAP solutions:
- Log4Shell (Central Note 3131047): SAP continued to release patches for the Apache Log4j 2 remote code execution vulnerability, with specific updates for Process Orchestration (note 3130521), Data Intelligence (3130920), and Business One (3131740).
- S/4HANA (Note 3112928): Addresses reflected cross-site scripting (XSS) and code injection vulnerabilities. The fix implements security checks for file uploads and downloads using the SAP Virus Scan Interface (VSI).
- SAP NetWeaver AS ABAP (Note 3123196): Patches a high-priority OS code injection vulnerability. This flaw could be exploited via transaction SE24 (Class Builder) or SE80 (Object Navigator) by users with specific
S_DEVELOPauthorization object permissions.
How can I mitigate the S/4HANA code injection risk?
The vulnerability addressed by note 3112928 involves malicious file uploads or downloads. To mitigate this risk, SAP recommends utilizing the SAP Virus Scan Interface (VSI), which provides a standardized framework for integrating third-party anti-virus software. This ensures that any files imported into the SAP system are scanned for malicious code before execution.
Summary of January 2022 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3131047 (Central) | Log4j 2 | Remote Code Execution | Critical (Log4Shell) |
| 3112928 | S/4HANA | XSS / Code Injection | File Upload Security |
| 3123196 | NetWeaver AS ABAP | OS Code Injection | Privilege Escalation |
Frequently Asked Questions
Why is the Log4Shell vulnerability still a priority?
Log4Shell (Apache Log4j 2) remains a critical threat due to its potential for remote code execution. SAP continues to release solution-specific patches (such as those for Process Orchestration and Business One) to ensure all components within a landscape are protected.
How do I mitigate the OS code injection risk in NetWeaver AS ABAP?
The vulnerability in note 3123196 requires authorization for the S_DEVELOP object with specific values (CLAS and 16). Restricting access to these permissions in transaction SE24 or SE80 is an effective way to mitigate the risk until the patch is applied.
What is the purpose of the SAP Virus Scan Interface (VSI)?
The VSI provides an interface that allows third-party anti-virus software to scan files imported into SAP. It is a critical defense mechanism against the import of malicious files that could otherwise lead to code injection or system compromise.