The SAProuter is a critical reverse proxy for remote SAP access, but its internet-facing position makes it a high-value target for remote exploits. Proper configuration—including restricted route permission tables, enforced SNC, and regular patching—is essential to prevent attackers from using the SAProuter to pivot into and compromise internal SAP servers.
Executive Summary
As remote work increases reliance on the SAProuter, organizations must address the security risks inherent in its role as a reverse proxy. Because the SAProuter provides a direct path between external networks and internal SAP landscapes, it acts as an accessible entry point for attackers. By scanning for the standard port 3299, attackers can identify exposed SAProuters and send information requests to map internal IP schemes. Once the network is mapped, attackers can pivot through the SAProuter to scan for open ports, such as HTTP, SMTP, or SSH, and execute targeted exploits against SAP servers, including unauthenticated SOAP requests to the SAP Host Agent. Securing the SAProuter requires a layered defense: implementing strict saprouttab rules, enforcing Secure Network Communications (SNC), using non-standard ports, and ensuring binaries are fully patched. By isolating the SAProuter in a Demilitarized Zone (DMZ) and enabling rigorous logging, organizations can significantly reduce the risk of unauthorized access and potential system compromise.
Key Takeaways
- The SAProuter is a high-value target for attackers because it provides a direct path to internal SAP systems.
- Attackers use information requests to map internal network IP schemes and identify vulnerable services.
- Route permission tables in the
saprouttabfile must be strictly configured, avoiding wildcards and blocking native connections. - Enforce SNC using KT and KP entries and update SAProuter binaries to mitigate known vulnerabilities.
- Isolate the SAProuter in a DMZ and monitor logs for suspicious connection requests or port scans.
How do attackers exploit the SAProuter?
Attackers exploit the SAProuter by leveraging its role as a direct, internet-facing proxy to scan and pivot into internal networks. Because the SAProuter listens on the standard port 3299, it is easily discoverable via port scans. Once identified, attackers send information requests to the proxy, which often discloses details about connected hosts. This allows attackers to enumerate the internal IP address scheme. With this information, they can send connection requests through the SAProuter to scan internal servers for open ports—not just for SAP services, but also for HTTP, SMTP, FTP, and SSH. Finally, attackers pivot through the proxy to execute exploits, such as sending unauthenticated SOAP requests to the SAP Host Agent on port 1128 to identify and brute-force operating system users.
How can you configure the SAProuter for security?
Securing the SAProuter requires a combination of strict access controls, protocol hardening, and infrastructure isolation.
| Security Measure | Implementation Detail |
|---|---|
| Route Permission Table | Define specific source hosts and target hosts; avoid using wildcards. |
| Native Connections | Block using S entries in the saprouttab file instead of P entries. |
| SNC Enforcement | Use KT and KP entries to force Secure Network Communications. |
| Information Requests | Disable disclosure by using the -Z option. |
| Network Port | Switch from the standard port 3299 to a non-standard port. |
| Infrastructure | Install the SAProuter in a DMZ on a C2 class compliant OS. |
How do you maintain and monitor the SAProuter?
Maintaining and monitoring the SAProuter is necessary to protect against evolving threats and detect active exploitation attempts. You should keep SAProuter binaries updated to the latest version to apply critical patches for program vulnerabilities, such as those addressed by notes 1820666 and 1663732. For monitoring, enable logging using the -G option. Once enabled, integrate the logs with SAP Solution Manager to receive alerts for suspicious activity, including rejected connection requests, port scans, and unauthorized native connections.
FAQ: Securing SAProuter
Why is the SAProuter a target for cyber attacks?
The SAProuter is a target because it acts as an internet-facing reverse proxy that provides a direct path into an organization’s internal SAP landscape. If misconfigured, it allows attackers to map the internal network and pivot to vulnerable SAP servers.
What is the best way to control access through the SAProuter?
You should define strict rules in the saprouttab file. Permit only authorized source hosts to connect to specific target hosts and services. Avoid wildcards in your route strings, and use S entries to block native connections instead of P entries.
Does SAP recommend specific OS hardening for the SAProuter?
Yes, SAP recommends installing the SAProuter in a Demilitarized Zone (DMZ) on a host running a C2 class compliant operating system to ensure a hardened environment.
How can I detect if my SAProuter is being scanned?
Enable logging on the SAProuter using the -G option. By monitoring these logs via SAP Solution Manager, you can identify and alert on suspicious patterns, such as port scans, connection requests, or unauthorized attempts to retrieve information.