The February 2021 SAP security updates addressed critical vulnerabilities across key enterprise platforms, most notably a remote code execution (RCE) flaw in SAP Commerce. Organizations using SAP Commerce, SAP Business Warehouse, SAP S/4HANA, and SAP ECC were advised to review and apply these specific security notes to mitigate unauthorized access and code injection risks.
Executive Summary
In February 2021, SAP released security updates targeting high-priority risks in several core product lines. The most critical update, SAP Security Note 3014121, patched a remote code execution vulnerability in the SAP Commerce Backoffice application. This flaw allowed authenticated attackers to inject malicious code via the DroolsRule item type due to misconfigured default permissions.
Beyond SAP Commerce, the release included updates for SAP Business Warehouse (SAP BW) and specific authorization controls for ERP environments. SAP Security Note 2986980 addressed SQL injection vulnerabilities and missing authorization checks within the Database Interface for SAP BW releases 7.0x. Additionally, SAP introduced switchable authorization checks for sensitive remote function call (RFC)-enabled modules in SAP S/4HANA and SAP ECC through notes 2743329 and 2475705. These updates emphasize the ongoing necessity of maintaining strict user permission configurations and monitoring interface security to prevent unauthorized system exploitation.
Key Takeaways
- Critical RCE Patched: SAP Security Note 3014121 addresses a remote code execution vulnerability in the SAP Commerce Backoffice application.
- BW Database Security: SAP Security Note 2986980 fixes SQL injection and authorization flaws in the SAP BW Database Interface.
- RFC Module Protection: Notes 2743329 and 2475705 implement switchable authorization checks for sensitive RFC-enabled modules in S/4HANA and SAP ECC.
- Permission Misconfiguration: The SAP Commerce vulnerability stemmed from default user permissions that allowed lower-privileged users to edit scripting facilities in DroolsRules.
Summary of February 2021 SAP Security Notes
The following table summarizes the key security advisories released by SAP in February 2021.
| SAP Note | Affected System | Primary Issue |
|---|---|---|
| 3014121 | SAP Commerce | Remote Code Execution / Misconfigured Permissions |
| 2986980 | SAP Business Warehouse | SQL Injection / Missing Authorization Checks |
| 2743329 | S/4HANA & SAP ECC | Sensitive RFC-enabled module authorization |
| 2475705 | S/4HANA & SAP ECC | Sensitive RFC-enabled module authorization |
What is the critical vulnerability in SAP Commerce?
The critical vulnerability in SAP Commerce, addressed by note 3014121, is a remote code execution flaw within the Backoffice application. It occurs because the DroolsRule item type exposes scripting facilities via its ruleContent attribute. Due to a misconfiguration in default user permissions, lower-privileged users could gain the ability to modify these rules and inject malicious code. Organizations can mitigate this by applying the patch or disabling script editing facilities for DroolsRules as a secondary defense.
What updates affect SAP Business Warehouse?
SAP Security Note 2986980 provides necessary patches for SAP Business Warehouse releases 7.0x. This update specifically targets security weaknesses in the Database Interface, including SQL injection vulnerabilities and missing authorization checks. Users operating these versions of SAP BW are encouraged to apply the note to secure their database interface communication.
How do I manage sensitive RFC-enabled modules?
To manage sensitive RFC-enabled modules in SAP S/4HANA and SAP ECC, administrators should implement the switchable authorization checks provided in notes 2743329 and 2475705. These updates introduce additional security layers for RFC modules, ensuring that sensitive functions are protected by appropriate authorization requirements, thereby reducing the risk of unauthorized remote function execution.