In September 2021, SAP released critical security updates addressing high-priority vulnerabilities across the NetWeaver, Knowledge Management, and Contact Center platforms. These patches resolve severe risks, including remote code execution, OS command injection, and improper input handling, requiring immediate attention from security administrators to protect SAP landscapes.
What was the most critical update in September 2021?
The most critical update was Hot News note 3078609, which patches a missing authorization check in the JMS Connector Service of SAP NetWeaver Application Server for Java.
- Risk: This vulnerability allows unauthenticated attackers to execute arbitrary code remotely.
- Severity: It carries the maximum CVSS score of 10/10.
- Resolution: Apply the provided patch immediately. If a patch cannot be implemented, a temporary workaround is available via note 3093977.
Which other SAP components were patched?
SAP addressed several other significant vulnerabilities throughout the month:
- SAP NetWeaver Knowledge Management (Note 3081888): Patches a code injection vulnerability in XMLForms. It updates the XMLToolkit parser to prevent the execution of malicious XSL stylesheet files containing OS-level commands.
- SAP Contact Center (Note 3073891): Resolves multiple OS command injection and reflected Cross-Site Scripting (XSS) vulnerabilities caused by improper user input encoding.
- SAP NetWeaver Visual Composer (Note 3084487): Removes a vulnerable component that could be exploited to upload malicious files, allowing attackers to run OS commands with the privileges of the Java Server process.
- SAP Backend Function Modules (Note 3089831): Introduces input validation to prevent unauthorized remote execution of function modules that could lead to backend database access.
Summary of September 2021 SAP Security Notes
| SAP Note | Component | Vulnerability Type | Impact |
|---|---|---|---|
| 3078609 | NetWeaver AS Java | Missing Authorization | Remote Code Execution |
| 3081888 | Knowledge Management | Code Injection | OS Command Execution |
| 3073891 | Contact Center | OS Command Injection / XSS | System Access |
| 3089831 | Backend Function Modules | Remote Execution | Database Access |
| 3084487 | Visual Composer | Unrestricted File Upload | OS Command Execution |
Frequently Asked Questions
Why is the JMS Connector Service vulnerability rated 10/10?
The missing authorization check in the JMS Connector Service (Note 3078609) allows unauthenticated, remote attackers to execute arbitrary code on the system. Because it requires no user interaction or privileges, it presents the highest possible level of risk to SAP NetWeaver Java environments.
How do I mitigate the XMLForms vulnerability?
The vulnerability in XMLForms is caused by the XMLToolkit parser executing malicious XSL stylesheet files. Note 3081888 provides a patch that secures the parser, preventing it from executing scripts that contain OS-level commands.
What is the risk associated with the Visual Composer vulnerability?
Note 3084487 removes a component that allowed for unrestricted file uploads. Attackers could exploit this to upload malicious files that execute OS commands with the same high-level privileges as the Java Server process, leading to data modification or denial of service.