Advisory
A note with CVSS 5.4 for component BC-DWB-SEM was released by SAP on 10.09.2024. The correction/advisory 3488039 was described with "[Multiple CVEs] Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform" and affects the system type ABAP.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is multiple vulnerabilities within ABAP.
Missing authority checks are still the most common security defect related to authorizations in custom code. Since SAP uses an explicit authorization model, an authority checks must be coded in order to be executed. If an explicit check is not coded, all users have access. This type of vulnerability not only exists in SAP standard it also exists in customer coding. Check your custom developments for vulnerabilities that pose a risk to your systems. SecurityBridge helps detect code vulnerabilities before they are implemented in production.
Risk specification
This Security note addresses six Missing Authorization check vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform. The vulnerability details along with their relevant CVE and CVSS information can be found below: SAP NetWeaver Application Server for ABAP and ABAP Platform allows a malicious user to alter the Easy Access menu of a legitimate user causing multiple impact on the RFC enabled function module. CVE-2024-42371 - The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces and nodes.There is low impact on integrity and availability of the application. CVSS: 5.4; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2024-44117 - The RFC enabled function module allows a low privileged user to perform various actions, such as modifying the URLs of any user's favourite nodes and workbook ID.There is low impact on integrity and availability of the application. CVSS: 5.4; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2024-45285 - The RFC enabled function module allows a low privileged user to perform denial of service on any user and also change or delete favourite nodes. By sending a crafted packet in the function module targeting specific parameters, the specific targeted user will no longer have access to any functionality of SAP GUI. There is low impact on integrity and availability of the application. CVSS: 5.4; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2024-42380 - The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability.There is low impact on confidentiality of the application. CVSS: 4.3; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2024-44115 - The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application. CVSS:4.3; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2024-44116 - The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application. CVSS:4.3; CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSolution
The correction provided in this SAP Security Note disables the call by RFC for the affected function modules. Please implement the Support Package mentioned in this SAP Security Note or the respective correction instruction. Workaround Please assess the workaround applicability for your SAP landscape prior to implementation. Note that this workaround is a temporary fix and is not a permanent solution. SAP strongly recommends you apply the corrections outlined in the security note, which can be done in lieu of the workaround or after the workaround is implemented. As a workaround you may withdraw permission S_RFC with field RFC_TYPE with prefixed value for SMTR_NAVIGATION_MODULES_BX or field RFC_NAME with value of the function modules of the function group SMTR_NAVIGATION_MODULES_BX. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "Update in progress".
Affected System
The advisory 3488039 describes a problem within an ABAP based systems of a specific version. Affected versions are described below. ABAP software is deployed in various software components and is widely used within the SAP product portfolio.
SAP NetWeaver Application Server (formally known as SAP Web Application Server) is a building block of SAP NetWeaver. It is the foundation for most software products developed by SAP SE. SAP NetWeaver systems exist with Java and/or ABAP stacks. The advisory could be relevant for single and dual-stack ABAP installations.
The advisory is valid for
- SAP_BASIS 700 67
- SAP_BASIS 701 5
- SAP_BASIS 702 9
- SAP_BASIS 731 78
- SAP_BASIS 740 81
- SAP_BASIS 750 78
- SAP_BASIS 751 4
- SAP_BASIS 752 3
- SAP_BASIS 753 4
- SAP_BASIS 754 3
- SAP_BASIS 755 7
- SAP_BASIS 756 3
- SAP_BASIS 757 3
- SAP_BASIS 758 4
- SAP_BASIS 912 5
