Layer Seven Security

The Most Critical SAP Security Notes of 2024

Layer Seven on December 16, 2024

Security notes are released by SAP on the second Tuesday of every month to address vulnerabilities in SAP solutions. The vulnerabilities are discovered by external security researchers and reported as part of SAP’s disclosure program. They are also discovered directly by SAP through its’s ongoing research and testing. Security notes are scored by SAP using version 3.0 of the Common Vulnerability Scoring System (CVSS). CVSS generates a score from 0 to 10 based on the severity of the vulnerability. SAP also assigns a priority level for each note. Critical notes are categorized as hot news.

There were over 150 security notes released in 2024 to address vulnerabilities in SAP solutions. The average CVSS score was 5.9. Approximately 1 in 4 of the notes were categorized as hot news or high priority. This article reviews the most important security notes of 2024, based on CVSS score. Hot news notes should be prioritized for implementation. Often, workarounds included in some notes can be applied to mitigate risks if the corrections cannot be applied immediately.

Note 3479478 [CVE-2024-41730] is the one of the highest rated notes of 2024 with a CVSS score of 9.8. The note patches a missing authentication check in SAP BusinessObjects Business Intelligence Platform (BOBJ). The vulnerability can be exploited by attackers to compromise logon tickets using a REST endpoint if Single Sign-On is enabled. The property Trusted_Auth_Shared_Secret can be set to Disabled in the effected files to mitigate the vulnerability if BOBJ cannot be upgraded to the required patch level immediately.

Note 3455438 also has a CVSS score of 9.8. The note addresses code injection and remote code execution vulnerabilities in open-source components bundled in SAP CX Commerce. This includes API tools in Swagger UI and database drivers in Apache Calcite Avatica. The solutions referenced in the note remove the vulnerable components in Swagger UI and upgrade Apache Calcite Avatica to the recommended version. There are no workarounds.

Note 3448171 patches CVE-2024-33006 for a critical file upload vulnerability in SAP NetWeaver Application Server ABAP (AS ABAP). The CVE is rated 9.6. The vulnerability can be exploited to bypass malware scanning and completely compromise SAP systems. The correction and workaround detailed in the note apply signature checks for the FILESYSTEM and SOMU_DB content repositories. The vulnerability impacts most version of the SAP_BASIS component in AS ABAP.

Note 3425274 [CVE-2019-10744] patches a code injection vulnerability in SAP Build Apps. The vulnerability arises from specific versions of the Lodash open-source JavaScript library used for programming tasks included in SAP Build Apps. Applications should be rebuilt with version 4.9.145 or later to prevent the vulnerability.

SAP Build Apps is also vulnerable to CVE-2024-29415, a severe Server-Side Request Forgery (SSRF) vulnerability detailed in note 3477196.

Note 3536965 [CVE-2024-47578] addresses SSRF and information disclosure vulnerabilities in Adobe Document Services of SAP NetWeaver AS for JAVA (AS Java). Updating the ADSSAP software component to the recommended patch level will remove the vulnerabilities in the relevant web applications and services in AS Java.

Note 3433192 [CVE-2024-22127] deals with a code injection vulnerability in the Administrator Log Viewer plug-in of AS Java. The vulnerability requires administrative privileges for successful exploitation. Therefore, restricting the use of the Administrators role can mitigate the vulnerability.

Note 3420923 [CVE-2024-22131] patches a vulnerable RFC service in AS ABAP to prevent a critical code injection vulnerability. The workaround in the note recommends restricting access to function modules for CA-SUR using authorization object S_RFC.

Other important notes include 3413475 for multiple CVEs in SAP Edge Integration Cell and 3412456 [CVE-2023-49583] which addresses an escalation of privileges vulnerability in node.js applications created using SAP Business Application Studio, SAP Web IDE Full-Stack or SAP Web IDE for SAP HANA.

SAP Security Notes, December 2024

Layer Seven on December 12, 2024

Hot news note 3536965 addresses multiple high risk vulnerabilities in Adobe Document Services (ADS) of SAP NetWeaver Application Server for JAVA (AS Java). This includes vulnerabilities for Server-Side Request Forgery (SSRF) and information disclosure. ADS should be updated to the recommended patch levels detailed in the note. There are no workarounds provided by SAP.

Note 3542543 deals with a SSRF vulnerability in the NetWeaver Administrator of AS Java. The vulnerability is caused by insufficient authentication checks for a specific servlet. The note includes details for disabling the servlet as a workaround.

Note 3520281 was re-released with updated information for a cross-site scripting vulnerability in SAP Web Dispatcher. The note includes several workarounds if Web Dispatchers and Kernels cannot be upgraded to the recommended patch levels within a reasonable timeframe.

Note 3469791 patches an information disclosure vulnerability that could lead to the compromise of credentials for RFC destinations in SAP NetWeaver Application Server ABAP (AS ABAP). The vulnerability can be mitigated by setting profile parameter rfc/dynamic_dest_api_only to the value 1. This will deactivate the legacy dynamic destination.

Finally, note 3504390 addresses a NULL Pointer Dereference (NPD) vulnerability in AS ABAP that can be exploited by attackers to trigger a denial of service.

Buyers Guide to SAP Enterprise Threat Detection

Layer Seven on November 27, 2024

SAP Enterprise Threat Detection (ETD) is the premier solution from SAP for identifying and responding to cyber attacks in SAP applications. ETD collects and analyzes log data from SAP systems and uses predefined patterns to detect Indicators of Compromise (IOCs) and trigger alerts for suspected security incidents. ETD includes graphical tools to support log analysis and detailed forensic investigation. Users can also create and publish custom patterns and alerts.

In addition to identifying potential threats, SAP ETD monitors the implementation status of required security notes in SAP solutions. Users can review the details of relevant notes including CVSS information and maintain the processing status of each note.

Anomaly detection is also supported by SAP ETD. The solution includes several patterns for anomalies, defined as events that deviate from normal or usual behavior in system landscapes.

ETD is a powerful solution capable of detecting and responding to cyber threats against SAP solutions in real time. It is available as an on-premise or cloud deployment, and can even be licensed as a managed service.

However, there are several drawbacks with SAP ETD, especially in comparison to alternative solutions available from SAP partners.

Unlike solutions such as the Cybersecurity Extension for SAP that use an addon approach to implementing advanced threat and response for SAP applications, ETD requires additional servers and infrastructure to host required components including SAP HANA, Kafka, Zookeeper, and streaming tools. This leads to more complex installation and maintenance procedures compared to software addons that can be installed and maintained in existing systems within SAP landscapes with comparatively low effort.

ETD is also bundled with relatively few attack detection patterns. The most current version and support package level of the on-premise edition of ETD includes approximately 175 patterns. The cloud edition of ETD provides fewer than 50 patterns. The recent release of the Cybersecurity Extension for SAP delivers far more coverage with over 1000 built-in patterns.

Furthermore, although ETD is capable of monitoring SAP infrastructure including third party databases and operating systems, standard patterns in ETD include very few patterns for the database and OS layer. In contrast, the Cybersecurity Extension for SAP includes hundreds of patterns not only for SAP databases such as HANA and ASE but operating systems including SUSE Enterprise Linux, Red Hat Enterprise Linux, and Windows Server.

However, the most important drawback of SAP ETD is that it does not support the full suite of cybersecurity capabilities to address cyber risks in SAP solutions.  ETD provides coverage for treat detection and patch management. However, it does not provide any support for other important areas such as access control, vulnerability management, custom code security, and compliance monitoring. Coverage for such areas would require the licensing of additional solutions from SAP or integrating capabilities from other platforms such as SAP Solution Manager. Full-suite solutions such as the Cybersecurity Extension for SAP provide integrated capabilities across all cybersecurity scenarios through a single, unified product and license. In addition to comprehensive threat detection and response with anomaly detection, the Cybersecurity Extension for SAP monitors critical access and segregation of duties risks for SAP solutions such as ECC and S/4HANA. It also performs automated vulnerability scans to detect more than 5000 vulnerabilities in SAP applications and infrastructure. Finally, it performs automated audits to detect compliance gaps with more than 15 regulatory and security frameworks and standards, including GDPR, NIST, PCI-DSS and the SAP Security Baseline.

SAP Security Notes, November 2024

Layer Seven on November 14, 2024

Note 3520281 patches a high priority Cross-Site Scripting (XSS) vulnerability in the SAP Web Dispatcher. The vulnerability can be exploited by attackers to execute arbitrary code and fully compromise Web Dispatcher installations. The vulnerability impacts users accessing the administration UI with a browser. The administration UI can be disabled as a workaround. This can be performed by deleting the content of directory /usr/sap/data/icmandir/admin/. The administration UI can also be deleted by removing icm/HTTP/admin_x parameters from the DEFAULT and instance profile and setting profile parameter icm/HTTP/admin_0 to an empty value. Another option is to remove administrative roles for all users. The admin role can be removed from users and replaced with the monitor role. The SAP Kernel and Web Dispatcher should be upgraded to required patch level for each version detailed in the note to fix the vulnerability. The correction will implement encoding to prevent a successful XSS attack.

Note 3483344 was updated with revised correction instructions to patch a high risk missing authorization check that could be exploited to escalate privileges in SAP PDCE. The note deactivates the vulnerable functions.

Note 3509619 patches a privilege escalation vulnerability in some versions of the SAP Host Agent installed in Unix platforms that enable attackers belonging to the sapsys group to replace local files usually protected by privileged access.

Note 3335394 resolves a missing authorization check in SAP NetWeaver AS Java that could lead to unauthorized access and changes to the System Landscape Directory (SLD).

Notes 3522953 and 3393899 deal with information disclosure vulnerabilities in the Software Update Manager and Logon Application of NetWeaver AS Java.

Cybersecurity Extension for SAP, Version 5.2: Support for SAP BTP, Critical Access and SOD for SAP ECC, and More

Layer Seven on October 22, 2024

The new release of the Cybersecurity Extension for SAP is scheduled for general availability in October and includes several important enhancements.

Version 5.2 includes 40+ alerts for security related incidents in SAP BTP. This includes application changes, remote logins, role changes, role grants to users, and cloud transports. The alerts monitor events logged in the BTP central audit log. Events in the log are replicated to the Cybersecurity Extension for SAP to support forensic analysis. Log records include details such as the log event ID, description, timestamp, terminal ID, and application details for each event. Similar to existing alerts for ABAP, HANA, and Java system types, as well as databases, operating systems, and SAProuter and Web Dispatcher installations, BTP alerts can be integrated with SIEM solutions for centralized monitoring.

Earlier releases provided coverage for business-level critical access and segregation of duties in SAP S/4HANA. The new release extends the coverage to SAP ECC. Despite the scheduled end of mainstream maintenance for SAP ECC in 2027, many SAP customers have yet to migrate to S/4HANA and therefore ECC will be a mainstay within SAP landscapes of many organizations for several more years. Version 5.2 of the Cybersecurity Extension for SAP includes 350+ functional checks for access to sensitive ECC transactions and conflicting combinations of transactions. The checks cover processes such as Finance, HR and Payroll, Materials Management, Order to Cash, and Procure to Pay in ECC. Users can add custom checks for transactions and combinations not included in the standard ruleset. This includes custom transactions. The coverage includes all of the relevant access risk IDs monitored by SAP GRC for ECC. Users and user groups can be excluded for specific checks to tune the coverage and prevent false positives. Usage rights are included in the standard license for the Cybersecurity Extension for SAP.

The new release also includes checks and alerts for the deactivation of SAP UI Masking & UI Data Protection Masking solutions. The solutions protect access to sensitive data in SAP user interfaces by masking or clearing fields. The contents of the fields containing sensitive data are only revealed to users with the required roles or attributes.

Finally, version 5.2 includes alerts for the execution of new ICF services with known security vulnerabilities. The services are not yet widely known or included in the scope of vulnerable ICF services that should be deactivated based on SAP recommendations in frameworks such as the SAP Security Baseline. There are also additional checks for the Secure Storage in the File System (SSFS), new sensitive transaction codes, dangerous function modules and external programs, and dynamic changes for specific security-related profile parameters.

SAP Security Notes, October 2024

Layer Seven on October 8, 2024

Hot news note 3479478 was updated for a critical missing authentication check in SAP BusinessObjects (BOBJ) Business Intelligence Platform. The vulnerability can be exploited to compromise logon tickets used for Single Sign-On. The update provides a fix for BOBJ 4.2 SP009. The notes includes details of a workaround that will disable trusted authentication in the Business Intelligence Platform Restful Web Services (BIPRWS) Web Application.

Note 3478615 patches a high-risk unrestricted file upload and malicious file execution vulnerability in BOBJ. In addition to applying the relevant support package patch detailed in the note, customers must create and maintain an access control list. The ACL should contain the list of folders that can contain personal data providers.

Note 3523541 addresses multiple vulnerabilities in Spring Framework and Log4j open-source libraries included in SAP Enterprise Project Connection. The patch included in the note updates the Spring framework and reload4j libraries to address the vulnerabilities.

Notes 3454858 and 3477359 deal with information disclosure vulnerabilities SAP NetWeaver Application Server (AS) ABAP and AS Java, respectively. The vulnerabilities could be exploited to access restricted file system information and usernames and passwords for new RFC destinations.

Security Logging and Alerting for SAP BTP

Layer Seven on September 24, 2024

SAP BTP is a cloud platform that is intended to decouple SAP customizations required by customers from underlying SAP solutions. As part of SAP’s drive for a clean core and to promote a modular architecture, BTP enables organizations to enhance and extend the capabilities of their SAP solutions by deploying custom code, integrations and other enhancements to a separate platform, without modifying standard SAP solutions. This is intended to realize more flexibility, easier scalability, faster upgrades, improved security, and, crucially, lower maintenance. Lower maintenance costs are especially important for SAP in the context of SAP RISE. Heavily customized environments increase the burden on SAP managed services for RISE customers. Therefore, RISE customers are provided with consumption credits for BTP by SAP.

On-premise customers can also benefit from BTP. They can access services for development, automation, integration, analytics, and artificial intelligence offered by both SAP and partners in BTP. For example, SAP Build Apps enables customers to rapidly develop and deploy applications with no-code or low-code using a drag-and-drop interface. This can dramatically lower development efforts for simple applications, More complex applications can be created using the SAP Business Application Studio cloud development environment together with the Cloud Application Programming Model and ABAP RESTful application model frameworks. The frameworks simplify application development by, for example, automatically generating required OData services based on data models. Developers can also leverage generative AI services in BTP to automatically generate ABAP code based on prompts.

Once developed, the applications can be deployed directly in BTP. Therefore, BTP supports both application development and application hosting for runtime services. Applications deployed to BTP can be integrated with on-premise solutions using the SAP Cloud Connector.

SAP BTP has a shared model of responsibility for security. Since BTP is a Platform-as-Service (PaaS), SAP is responsible for managing the infrastructure. Customers are responsible for application-level security including managing user authentication and role assignments, application maintenance and changes, and maintaining global account and sub-account settings. Sub-accounts are similar to environments in on-premise landscapes. They are used to separate development scenarios and projects. Each sub-account is a sandboxed environment. Users and roles are managed for each sub-account.

The Identity Authentication service authenticates BTP users using a federated model that separates authentication mechanisms from applications. The service supports Single Sign-On (SSO) via SAML 2.0 and two-factor authentication.

BTP services and applications record security-related events to a central Audit Log. Events are categorized by data access, data modification, security events, and configuration changes. Logged events include actions such as user logons and logoffs, changes to user permissions, groups and trust relationships, transports, and application creation, deletion and crashes. Log records include details such as the log event ID, description, timestamp, terminal ID, and application details for each event. The default retention period is 90 days for events in the Audit Log. A subscription to the premium edition of the Audit Log service is required to change the retention period and to log events from custom applications in BTP to the Audit Log.

The Audit Log can be analyzed using the Audit Log Viewer. The Viewer enables customers to query log data based on user, time, category, message content, and other fields. However, it returns a maximum of 500 records per query request. Records can be exported for offline analysis. A subscription to the Audit Log Viewer service is required to use the Viewer.

The Auditlog Management service can be activated for global accounts and/or subaccounts to integrate the BTP Audit Log with external systems using the Audit Log Retrieval API. The API is region-specific and secured by OAuth. Therefore, access tokens must be configured for external systems to consume the service. Request rates are throttled based on the region, ranging between 4-8 requests per second for each token and tenant. Log records are retrieved by HTTP GET requests from external systems to the BTP service.

The SAP Alert Notification Service provides an alternative method for monitoring and integrating BTP events with external systems. The service sends real-time notifications for events in BTP applications and services. It includes APIs to both create and consume alerts. Unlike the Audit Log Retrieval API, it supports native integration with incident management solutions such as ServiceNow, messaging channels such as email, and messaging platforms such as Slack and Microsoft Teams. It also supports feeds from cloud providers including Amazon CloudWatch, Microsoft Azure Monitor, and Google Cloud Platform Operations. Another benefit of the SAP Alert Notification Service over the Audit Log Retrieval API is built-in integration with the SAP Cloud Transport Management Service and SAP Automation Pilot. The latter is a BTP service that supports automated response handling for alerts.

The Cybersecurity Extension for SAP supports both the Audit Log Retrieval API and the SAP Alert Notification Service to monitor and alert for security events in SAP BTP. Security alerts for BTP are combined with alerts for other SAP applications, databases, hosts and services for end-to-end monitoring of SAP cloud and on-premise landscapes. Events and alerts for all SAP solutions including BTP are integrated by the Cybersecurity Extension for SAP with SIEM systems including Splunk, QRadar, LogRhythm, Sentinel and many more.

SAP Security Notes, September 2024

Layer Seven on September 10, 2024

Note 3459935 was updated in September with revised solution details to patch a high priority information disclosure vulnerability in SAP Commerce Cloud. Some OCC API endpoints in SAP Commerce Cloud allow Personally Identifiable Information (PII) data, such as passwords, to be included in the request URL as query or path parameters. The impacted endpoints are detailed in the note. The note includes patches for both the cloud and on-premise editions. A workaround is also included in the note if the corrections can not be implemented within a reasonable timeframe.

Note 3505503 addresses a Cross-Site Scripting (XSS) vulnerability in the logon application of SAP NetWeaver Application Server (AS) Java. Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. The solution included in the note encodes parameters to address the vulnerability.

Notes 3501359 and 3498221 patch Cross-Site Scripting vulnerabilities in SAP CRM and SAP Enterprise Portal.

Note 3488039 deals with multiple missing authorizations in SAP NetWeaver Application Server (AS) ABAP and ABAP Platform. The authorizations impact function modules in function group SMTR_NAVIGATION_MODULES_BX. As a workaround, you may withdraw permission S_RFC with field RFC_TYPE with prefixed value for SMTR_NAVIGATION_MODULES_BX or field RFC_NAME with value of the function modules of the function group SMTR_NAVIGATION_MODULES_BX.

New Whitepaper: NIS2 Compliance for SAP Solutions

Layer Seven on August 20, 2024

The Network and Information Security (NIS2) Directive takes effect on October 17 and imposes significant requirements on organizations for cybersecurity and incident reporting. NIS2 mandates strict standards for cybersecurity and incident reporting for organizations that are based in the European Union or provide services within the EU. It is targeted at essential and important organizations in specific sectors considered part of the supply chain for critical infrastructure in member states.

The Directive includes requirements for protecting the confidentiality, integrity and availability of data in network and information systems against cyber threats, as well as detecting and reporting significant security incidents within prescribed time frames. This includes data and incidents impacting business-critical SAP solutions.

The newly-released whitepaper from Layer Seven Security simplifies the path to NIS2 compliance by providing guidance for complying with the Directive for SAP solutions. This includes sources for hardening standards to comply with cybersecurity requirements, and threat detection and response mechanisms to comply with the incident reporting requirements of the Directive. The guidance includes specific recommendations for solutions in SAP RISE.

DOWNLOAD

SAP Security Notes, August 2024

Layer Seven on August 16, 2024

Hot news note 3477196 deals with a critical Server-Side Request Forgery (SSRF) vulnerability in applications built with SAP Build Apps. SAP Build Apps are vulnerable to CVE-2024-29415 due to the use of an older version of an Nodejs library included in software components for AppGyver. AppGyver is an open-source development platform used by SAP Build Apps. Applications should be rebuilt with version 4.11.130 or later in SAP Build Apps to address the vulnerability.

Hot news note 3479478 for CVE-2024-41730 patches a missing authentication check in SAP BusinessObjects Business Intelligence Platform (BOBJ). The vulnerability can be exploited by threat actors to compromise logon tickets used for single sign-on with a REST endpoint. The fix included in the note secures the default configuration of single sign-on enterprise authentication.

Note 3485284 addresses a high priority XML injection vulnerability in the Export Web Service of BEx Web Java Runtime in SAP Business Intelligence version 7.50. The issue is specific to PDF export only using Java ALV and ADS.

Note 3459935 fixes an information disclosure vulnerability in SAP Commerce Cloud that could lead to the leakage of Personally Identifiable Information (PII) data in query or path parameters. This includes passwords, email addresses, mobile numbers, coupon codes, and voucher codes. The vulnerability impacts specific API endpoints detailed in the note. A workaround is included in the note. Vulnerable endpoints should be replaced with the new secure variants detailed in the solution section of the note.