In June 2021, SAP released critical security updates addressing vulnerabilities across SAP Commerce, SAP NetWeaver ABAP, and SAP NetWeaver AS Java. These patches resolve high-priority risks, including remote code execution, memory corruption, and unauthorized file system access, requiring immediate attention from security administrators.
What is the critical remote code execution risk in SAP Commerce?
Hot News note 3040210 addresses a critical remote code execution (RCE) vulnerability in the Source Rules of SAP Commerce (both on-premise and Public Cloud).
- Vulnerability: Authorized users in the Backoffice application can inject malicious code into source rules, which are then translated into drools rules and executed.
- Resolution: SAP has added validation and output encoding to the processing of Promotion and Source Rules.
- Workaround: If you cannot install the patch immediately, restrict the
SourceRuletype permissions to ensure only highly trusted employees have create and change privileges.
Which other SAP components were patched?
SAP also addressed several high-risk vulnerabilities in NetWeaver components:
- NetWeaver ABAP Memory Corruption (Notes 3021197, 3020209, 302010): These notes resolve multiple memory corruption vulnerabilities. Attackers can exploit these flaws by sending specially crafted requests to the Dispatcher process, SAP Gateway, or SAP Enqueue Server, potentially causing a denial of service (DoS).
- NetWeaver AS Java XML Validation (Note 3053066): Patches a missing XML validation vulnerability. Attackers could exploit this to read files from the file system or crash SAP services by submitting specially crafted XML files. The patch enables blocking of external entities via the XML parser.
Summary of June 2021 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3040210 | SAP Commerce | Remote Code Execution | Critical |
| 3021197 / 3020209 | NetWeaver ABAP | Memory Corruption | Denial of Service |
| 3053066 | NetWeaver AS Java | XML Validation | File System Access / DoS |
Frequently Asked Questions
How can I mitigate the RCE risk in SAP Commerce without a patch?
If the patch for note 3040210 cannot be applied immediately, you should perform a permission audit. Adjust the privileges for the SourceRule type to ensure that only highly trusted personnel can create or change these rules, effectively limiting the potential for malicious code injection.
What is the impact of the memory corruption vulnerabilities in NetWeaver ABAP?
These vulnerabilities, addressed in notes 3021197, 3020209, and 302010, allow attackers to target core processes like the Dispatcher, Gateway, and Enqueue Server. Successful exploitation results in a denial of service, potentially taking down critical SAP background processes.
How does the XML validation patch protect AS Java?
The patch for note 3053066 prevents the XML parser from resolving external entities. This stops attackers from using malicious XML files to traverse the file system or trigger service crashes, ensuring that the XML processing logic remains secure.