In October 2021, SAP released critical security updates addressing vulnerabilities across the NetWeaver, SAP Commerce, and Supply Chain Management platforms. These patches resolve high-priority security flaws, including broken authorization checks and XML External Entity (XXE) injection vulnerabilities, which could lead to unauthorized code execution or privilege escalation.
What was the most critical update in October 2021?
The most significant update was Hot News note 3097887, which patches a broken authorization check in SAP NetWeaver AS ABAP and the ABAP Platform. This vulnerability allows attackers with developer or administrator privileges to transfer malicious code to vulnerable systems via a LEAVE PROGRAM statement in a specific software logistics report.
- Impacted Versions: SAP Basis versions 700 through 756.
- Resolution: The note deletes the vulnerable report.
- Workaround: No workaround exists; the fix must be applied to remediate the vulnerability.
Which other SAP components were patched?
SAP also addressed several vulnerabilities in specialized business applications and components:
- SAP Environmental Compliance (Note 3101406): Patched an XML External Entity (XXE) injection vulnerability in the bundled XMLBeans open-source software. SAP replaced the vulnerable components with secure versions or closed-source alternatives.
- SAP Payment Engine (Note 2900326): Resolved a missing authorization check to prevent unauthorized access.
- SAP SuccessFactors (Note 3077635): Addressed a Denial of Service (DoS) vulnerability affecting mobile clients.
- SAP Commerce (Note 3110328): Implemented search restrictions to fix a missing authorization check in the B2B Accelerator, preventing potential privilege escalation.
Summary of October 2021 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3097887 | NetWeaver AS ABAP | Broken Authorization | Malicious Code Transfer |
| 3101406 | Environmental Compliance | XXE Injection | Data Import Risk |
| 2900326 | Payment Engine | Missing Authorization | Unauthorized Access |
| 3077635 | SuccessFactors Mobile | Denial of Service | Service Disruption |
| 3110328 | SAP Commerce | Missing Authorization | Privilege Escalation |
Frequently Asked Questions
Why does note 3097887 not offer a workaround?
The vulnerability in the SAP NetWeaver software logistics report is severe enough that the only viable security measure is the removal of the vulnerable report itself. Because the report is deleted upon applying the note, no functional workaround exists to maintain the report’s original behavior while remaining secure.
What is the risk associated with the XXE vulnerability in SAP Environmental Compliance?
The XXE vulnerability exists within bundled open-source software (XMLBeans) used for data imports. An attacker could exploit this to perform unauthorized actions or access data by manipulating XML data structures during the import process.
How does the patch for SAP Commerce affect the B2B Accelerator?
Note 3110328 applies search restrictions to ensure that authorization checks are properly enforced. Without this patch, an attacker could potentially bypass access controls, leading to an escalation of privileges within the B2B Accelerator environment.