In March 2022, SAP released critical security updates addressing the high-profile ICMAD (Internet Communication Manager Advanced Desync) vulnerability, which posed a severe risk of remote system compromise. Additionally, SAP continued its efforts to mitigate the impact of the Log4Shell vulnerability by patching mobile components.
What is the ICMAD vulnerability?
The ICMAD (Internet Communication Manager Advanced Desync) vulnerability (CVE-2022-22536) is a memory corruption flaw that impacts SAP NetWeaver AS ABAP and the SAP Web Dispatcher. It can be exploited by unauthenticated attackers via a single HTTP request to remotely compromise an SAP system.
- Affected Components: SAP NetWeaver AS ABAP and Web Dispatcher when accessed through an HTTP gateway.
- Resolution: Administrators must update SAP Kernels and Web Dispatchers to the minimum patch levels specified in SAP note 3123396.
- Workaround: If immediate patching is not possible, apply the workaround in note 3137885 by setting the profile parameter
wdisp/additionalconnclosetoTRUE.
How were other SAP components affected in March 2022?
In addition to the ICMAD patches, SAP addressed vulnerabilities in other key areas:
- SAP NetWeaver AS Java (Note 3123427): This note provides an ICMAD patch for Java-based systems. If support for HTTP pipeline requests is not required, administrators can apply the workaround by setting the parameter
icm/handlehttppipeline_requests=FALSE. - SAP Work Manager (Note 3154684): As part of the ongoing response to the Log4Shell (Apache Log4J 2) vulnerability, SAP released this note to patch the mobile solution SAP Work Manager, extending the coverage of the central note 3131047.
Summary of March 2022 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3123396 | AS ABAP / Web Dispatcher | ICMAD (Memory Corruption) | Critical |
| 3123427 | AS Java | ICMAD (Memory Corruption) | Critical |
| 3154684 | SAP Work Manager | Log4Shell (RCE) | Critical |
Frequently Asked Questions
What makes the ICMAD vulnerability so dangerous?
ICMAD is a memory corruption vulnerability that allows unauthenticated, remote attackers to fully compromise an SAP system through a single HTTP request. Because it bypasses traditional authentication, it requires immediate patching or the application of provided workarounds.
Does ICMAD impact all SAP application servers?
No, the vulnerability specifically impacts SAP NetWeaver AS ABAP and the Web Dispatcher when accessed through an HTTP gateway. Direct access to SAP application servers is not impacted by this specific vulnerability.
How can I verify if my Web Dispatcher is protected against ICMAD?
You should refer to SAP note 3137885 to ensure your Web Dispatcher installations meet the minimum required patch levels. If you cannot patch immediately, you can apply the stop-gap workaround by setting the wdisp/additionalconnclose parameter to TRUE.