SAP fixed four vulnerabilities that don't need any login to exploit as part of its monthly Security Patch Day, and the company rates all four at 10.0, the highest possible CVSS score. Three of the flaws affect the SAP NetWeaver application server, the platform that runs SAP systems, while the fourth sits in the Web Dispatcher, which routes web requests from the internet to that server. The flaws could let attackers run code, log in as any user, or impersonate the system's own servers without any user interaction.
The flaws span four components, according to SAP's November security bulletin. Two vulnerabilities—one in the Web Dispatcher and another in the Internet Communication Manager, which handles the server's web traffic—could allow an attacker with network access to execute code. A third flaw in the server's SAML 2.0 service provider, which delegates user sign-in to an identity provider, could let an attacker log in as any user on some systems using SAML single sign-on, including privileged users, potentially leading to full compromise and possibly reaching connected systems. The fourth vulnerability in SAP Gateway, which links the server to other SAP systems and programs, could let an attacker pose as one of the system's own servers and carry out unauthorized actions. Onapsis, an SAP security firm whose researchers discovered the ICM, Web Dispatcher, and Gateway flaws, notes that kernels no longer under maintenance—including versions 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85, and 7.89—are also affected but may not receive fixes and will need upgrades to supported versions.
The ICM and Web Dispatcher flaws stem from a single bug that Onapsis calls ICM2SHELL, found in shared kernel code that reassembles split WebSocket messages. The vendor's notes indicate that specially crafted network traffic could corrupt memory, and a successful attacker could then execute code and fully compromise the system. Onapsis provided SAP with a working exploit that runs operating system commands as the account that owns the SAP installation, and the same bug can crash either component—a crashed Web Dispatcher cuts off every SAP system behind it during restart. WebSocket support is enabled by default, so systems are exposed even if nothing uses the feature. For the Gateway flaw, which researchers call PROXYGATE, exposure depends on the gateway's proxy list or a profile parameter when that list is missing, not on the access control lists most hardening guidance covers. Where proxy settings permit, crafted requests make the gateway treat an outside attacker as one of its own application servers, potentially allowing that attacker to run operating system commands.
RedRays, a company that reviewed the notes today, recommends updating the kernel and all Web Dispatchers in a single rollout that covers all 17 of this month's kernel and Web Dispatcher fixes. For the SAML flaw, any AS ABAP system using SAML2 for browser logon should be treated as in scope until proven otherwise, and there's no workaround—only the correction instructions or listed support package will fix it. For the Gateway vulnerability, Onapsis advises checking the proxy list first, since a permissive one open to broad networks leaves a system exposed at any patch level, and restricting it should start with gateways reachable from the internet. The kernel patch alone, without a restrictive proxy list or the profile parameter set to block all proxy connections, doesn't remove a system from scope. For the ICM and Web Dispatcher flaws, turning off WebSocket support blocks the bug as a last resort until patches are applied, though this breaks features that depend on it, and organizations need to locate every Web Dispatcher because one missed instance leaves the flaw open. The researchers haven't seen any of these bugs exploited in attacks, but the combination of maximum severity scores and no login requirement means patching should be the top priority for every SAP shop. Organizations running critical enterprise systems will need to weigh the operational disruption of an emergency patch cycle against the risk of leaving remotely exploitable, authentication-free vulnerabilities open in their most sensitive infrastructure.