SAP fixes NetWeaver flaws that let attackers run code without signing in

SAP’s November patch day fixes memory corruption flaws in SAP NetWeaver’s Internet Communication Manager and in SAP Web Dispatcher. Either could let an attacker with no account run code and fully compromise the system, SAP says. Two more flaws it rates 10.0 could let an unauthenticated attacker pass as an internal server to SAP Gateway, or pose as any user through SAML sign-in. SAP published fixes in its notes and urges customers to apply them on priority.

SAP describes the two memory corruption flaws the same way. The component doesn’t check certain network input well enough, so crafted traffic can corrupt memory and let the attacker run code. One is in the Internet Communication Manager of SAP NetWeaver AS ABAP, and the other in SAP Web Dispatcher.

The SAP Gateway flaw comes from a default access control list with high privileges, which lets an outside attacker pass as an internal application server, SAP says. The SAML flaw affects AS ABAP systems acting as a SAML service provider in certain configurations. They don’t check incoming sign-in assertions well enough, so an attacker could pose as any user, including privileged accounts.

SAP rates all four 10.0 under CVSS 3.1, with no account or user action needed. The same patch day fixes three flaws rated 9.9 that need a low-privilege account. They are an operating system command injection flaw in the ABAP application server, a code injection flaw in NetWeaver Knowledge Management’s XML Forms and a missing authorization check in S4CRM.

Neither SAP nor the CVE records report attacks or public exploit code, and the records had no CISA assessment when they were read on Nov 10. The notes that give each fixed patch level sit behind SAP’s support sign-in, so the versions below are the ones SAP lists as affected.