SAP Security Notes – July 2023

On the 11th of July 2023, SAP Security Patch Day saw the release of 16 new Security Notes.

There were 2 updates to previously released Security Notes.

Notes by severity

Highlights

On July Patch Day SAP presented 9 high-severity Notes, 2 of them were rated as HotNews and 7 were rated as a correction with high priority.

The list of Notes for today contains quite a few high-priority corrections, so let’s break down each of them one by one.

The Note with the highest CVSS Score is the usual Update pack for the browser control Google Chromium delivered with SAP Business Client – 2622660 – with a CVSS Score of 10. The Note was re-released with updated ‘Solution’ information.

This Security Note addresses various vulnerabilities in the third-party web browser control of the latest Chromium Stable Release, which can be used within SAP Business Client.

The second one that we will discuss is the Note for SAP S/4HANA IS-OIL component – 3350297 –  OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) – with a CVSS Score of 9.1. 

IS-OIL component in SAP ECC and SAP S/4HANA allows an authorized attacker to insert an arbitrary operating system command into an unprotected parameter in a default extension due to a programming error in the function module and report. The attacker can read or manipulate system data and shut down the system if the exploit is successful.

SAP NetWeaver receives a security patch for the add-on of Business Intelligence Platform in a Note 3331376 – Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) – with a CVSS Score of 8.7. 

An attacker with non-administrative privileges can overwrite system files by exploiting a directory traversal vulnerability. Although data from confidential files cannot be read, some OS files may be overwritten, resulting in system compromise.

SAP Web Dispatcher also got two notes for vulnerability mitigations:

Note 3233899 – Request smuggling and request concatenation vulnerability in SAP Web Dispatcher – with a CVSS Score of two ratings: 8.6 and 8.1 based on different CVSS Vectors described below:

The first scenario with an 8.6 rating: in SAP NetWeaver AS ABAP and SAP Web Dispatcher, an unauthenticated attacker can send a maliciously crafted request over a network to a front-end server, which can cause a back-end server to confuse the boundaries of malicious and legitimate messages, resulting in the execution of malicious payloads that can be used to make it temporarily unavailable, having a significant impact on availability.

The second scenario with an 8.1 rating: the scenario is pretty much the same except the maliciously crafted requests numbers are non-predictable and they can allow an attacker to read or modify information on the server or make it temporarily unavailable, adding a slight but significant chance to impact the confidentiality of a system.

Note 3340735 – Memory Corruption vulnerability in SAP Web Dispatcher – with a CVSS Score of 7.7 – describes the vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption via logical errors in memory management. This can result in information disclosure or system crashes, which can have a low impact on confidentiality but a high impact on the system’s integrity and availability.

SAP UI5 receives an update for the Note 3324285 – Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management) – with a CVSS Score of 8.2. This June-released note has been re-released with updated ‘Solution’ information.

In SAP SQL Anywhere the Denial of service vulnerability was discovered: Note 3331029 – Denial of service (DOS) vulnerability in SAP SQL Anywhere – with a CVSS Score of 7.8. An attacker may prohibit genuine users from accessing the service by crashing it. With a low-privileged account and local system access an attacker can write into shared memory objects, which leads to Denial of Service. An attacker may also be able to change sensitive data in shared memory objects. This issue affects only SAP SQL Anywhere on Windows. Other platforms are unaffected.

Last but not least on this respectably long list – the Diagnostics agent of SAP Solution Manager got two security patches:

Note 3352058 – Unauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent) – with a CVSS Score of 7.2. Unauthenticated attackers are permitted to execute HTTP requests blindly. The attacker can have a limited impact on the confidentiality and availability of the application and other applications that the Diagnostics Agent can contact if the exploit is successful.

Note 3348145 – Header Injection in SAP Solution Manager (Diagnostic Agent) – with the same CVSS Score of 7.2. An attacker is permitted to tamper with client request headers. This confuses SAP Diagnostics Agent, causing it to serve poisoned material to the server. The attacker can have a limited influence on the application’s confidentiality and availability if the exploit is successful.

Summary