The November 2022 SAP Security Notes address several critical and high-risk vulnerabilities, including a critical insecure deserialization flaw in the SAP BusinessObjects Business Intelligence Platform (BOBJ) and directory traversal issues in NetWeaver Application Server ABAP (AS ABAP). These updates are essential for maintaining the security of SAP environments.
Executive Summary
In November 2022, SAP released security updates addressing multiple vulnerabilities across its product portfolio. The most significant concern is a critical vulnerability, tracked as CVE-2022-41203, affecting the SAP BusinessObjects Business Intelligence Platform (BOBJ) versions 4.2 and 4.3. This flaw involves insecure deserialization of untrusted data within the Central Management Console (CMC) and BI Launchpad, which can allow threat actors to bypass authentication, inject malicious code, or cause a denial of service.
Additionally, the release addresses high-risk directory traversal vulnerabilities in NetWeaver Application Server ABAP (AS ABAP) under note 3256571 (CVE-2022-41214). These vulnerabilities stem from insufficient path validation, potentially allowing attackers to access remote-enabled function modules to read or delete restricted files. Finally, note 3249990 addresses denial of service vulnerabilities in the SQlite component bundled with SAPUI5, triggered by array-bounds overflow. Organizations using these platforms should prioritize reviewing these notes and applying the necessary patches or workarounds to mitigate potential exploitation.
Key Takeaways
- Critical BOBJ Flaw: CVE-2022-41203 in SAP BusinessObjects allows authentication bypass and code injection via insecure deserialization.
- NetWeaver AS ABAP Risk: CVE-2022-41214 enables directory traversal, potentially allowing attackers to read or delete restricted files.
- SQlite Vulnerability: Note 3249990 addresses denial of service risks in SQlite bundled with SAPUI5.
- Immediate Action Required: Organizations should review all November 2022 security notes and implement patches or provided workarounds immediately.
What are the critical vulnerabilities in the November 2022 SAP Security Notes?
The November 2022 security release focuses on mitigating risks across BOBJ, NetWeaver, and SAPUI5 environments. The following table summarizes the identified vulnerabilities:
| SAP Note | CVE ID | Component | Risk/Issue |
|---|---|---|---|
| 3243924 | CVE-2022-41203 | SAP BOBJ | Insecure Deserialization |
| 3256571 | CVE-2022-41214 | NetWeaver AS ABAP | Directory Traversal |
| 3249990 | N/A | SAPUI5 (SQlite) | Denial of Service |
How do you address the BOBJ Central Management Console vulnerability?
To address the vulnerability in the SAP BusinessObjects Business Intelligence Platform (BOBJ), customers can apply a temporary workaround by deleting specific files in the Tomcat directory. You must first backup the files located in the following folders:
webapps\BOE\WEB-INF\eclipse\plugins\webpath.AnalyticalReporting\web\jsp\Webi_DestinationFormatwebapps\BOE\WEB-INF\eclipse\plugins\webpath.AnalyticalReporting\web\jsp\Webi_Format
This workaround disables format selection when creating a Publication or Schedule, which may result in an HTTP 404 error in the Format area of the CMC. Note that this impact is limited to the CMC and does not affect the BI Launchpad.
Frequently Asked Questions
What is the primary risk associated with the SAP BOBJ vulnerability?
The vulnerability (CVE-2022-41203) involves insecure deserialization of untrusted data. If exploited, it can allow threat actors to bypass authentication, inject malicious code, or trigger a denial of service in the Central Management Console (CMC) and BI Launchpad.
Does the workaround for the BOBJ vulnerability affect BI Launchpad?
No, the workaround—which involves deleting specific files in the Tomcat directory—only impacts the CMC. It disables format selection during the creation of a Publication or Schedule, which will cause an HTTP 404 page in the Format area of the CMC, but it does not impact the BI Launchpad.
What causes the directory traversal vulnerability in NetWeaver AS ABAP?
The vulnerability (CVE-2022-41214) is caused by insufficient path validation. This flaw enables attackers to access remote-enabled function modules, which can then be used to read or delete restricted files within the AS ABAP environment.