Advisory
On 12.03.2024 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within HANA platform.
SAP Note 3410615 addresses "[CVE-2023-44487 ] Denial of service (DOS) in SAP HANA XS Classic and HANA XS Advanced" to prevent denial of service (dos) with a high risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
A vulnerability in SAP HANA XS Classic and HANA XS Advanced allows an unauthenticated user to perform a Denial of Service (DoS) attack by sending a large volume of HTTP/2 requests and then cancelling them, leading to potential memory overflow and significant application performance degradation.Solution
The issue has been addressed in SAP HANA Database 2.0, which now incorporates safeguards against this type of DoS attack. Additionally, the SAP HANA XS Advanced Model has been updated to include protections against this vulnerability. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "XS Classic and Advanced includes a Web Dispatcher 7.53 but HTTP/2 is NOT enabled by default.Add parameter icm/HTTP/support_http2=FALSE to disable HTTP/2. If access is done via an external SAP Web Dispatcher only, it is sufficient to apply the workaround in the external Web Dispatcher.".
Affected System
SAP HANA is a high-performance in-memory database and the basis for a so called "Real-Time Data Platform". SAP HANA allows online transaction processing (OLTP) and online analytical processing (OLAP) on one system. SAP HANA Extended Application Services (aka SAP HANA XS) is a key aspect of SAP HANA as a platform.
Additonal resources
The advisory is valid for
- 7.5 [CVE-2021-21446] Denial of service (DOS) in SAP NetWeaver AS ABAP and ABAP Platform
- 7.5 [CVE-2021-20223] Multiple Vulnerabilities in SQlite bundled with SAPUI5
- 7.5 [CVE-2023-40308] Memory Corruption vulnerability in SAP CommonCryptoLib
- 6.5 [CVE-2024-30218] Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
- 6.5 [CVE-2023-27270] Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform
