SAP has released a series of critical security patches addressing four significant vulnerabilities, each rated with the maximum CVSS score of 10.0. These vulnerabilities are particularly concerning as they can be exploited without any need for user authentication, impacting the SAP NetWeaver application server and the Web Dispatcher. In particular, the flaws in the Web Dispatcher and Internet Communication Manager could be exploited by attackers to execute remote code, posing a severe threat to systems if not promptly addressed.
Another vulnerability was identified in the SAML 2.0 service provider, potentially allowing unauthorized access to systems using SAML single sign-on by impersonating users. Similarly, a flaw in the SAP Gateway could enable attackers to impersonate internal servers, thus manipulating system actions without authorization. These vulnerabilities necessitate immediate attention as they do not require user interaction to be exploited.
SAP has provided individual notes for each flaw, detailing the affected versions and recommending urgent application of these fixes. The vulnerabilities affect kernels that are no longer maintained, which may not receive future updates. Organizations using these outdated kernels are advised to upgrade to maintained versions. Onapsis, a security firm that contributed to identifying these vulnerabilities, emphasized the urgency due to the potential for full system compromise and has shared exploit demonstrations with SAP.
Security experts from RedRays have advised a comprehensive update approach, ensuring all components including the kernel and Web Dispatchers are updated in a coordinated rollout. This will ensure that all vulnerabilities are addressed across affected systems, maintaining the integrity and security of SAP environments. Although no attacks exploiting these vulnerabilities have been reported yet, the potential severity necessitates immediate and thorough action.
