Skip links

3132964 – [CVE-2021-44228] Remote Code Execution vulnerability associated with Apache Log4j 2 component used in SAP Enable Now Manager

Description

Symptom

UPDATE 11th January 2022: This note has been re-released with updated ‘Reason and Prerequisites’ information. We have made some textual changes regarding validity.

Two methods of a utility class in SAP NetWeaver AS ABAP allows an attacker with high privileges and has direct access to SAP System, to inject code when executing with transaction (SE24 – Class Builder).

This could allow execution of arbitrary commands on the operating system, that could highly impact the Confidentiality, Integrity and Availability of the system.

Other Terms

Command Injection, OS command injection, CVE-2021-44235

Reason and Prerequisites

The following releases of component SAP_BASIS are affected

7.00 SP32-SP39 (*) / 7.01 SP17-SP24 (*) / 7.10 SP22-SP25 / 7.11 SP17-SP20 / 7.02 SP17-SP24 (*) / 7.30 SP13-SP21 / 7.31 SP15-SP30 (*) / 7.40 SP10-SP27 (*) / 7.50 SP00-SP22 / 7.51 SP00-SP13 / 7.52 SP00-SP09 / 7.53 SP00-SP07 / 7.54 SP00-SP05 / 7.55 SP00-SP03 /
7.56 SP00-SP01

(*) in case you are using license-bound product Post-Copy Automation (PCA) (check with transaction SAINT on tab installed products if the add-on PCAI_ENT is available) the lower validity of following releases are valid:

7.00 SP14-SP39 / 7.01 SP00-SP24 / 7.02 SP01-SP24 / 7.31 SP01-SP30 / 7.40 SP05-SP27

The user has permissions to use SE24/SE80 and execute development objects (authorization object = S_DEVELOP with fields OBJTYPE = CLAS and ACTVT = 16 ‘Execute’).

The compromised utility class is exclusively used for license bound SAP tool Post-Copy Automation (PCA) and has no impact on standard functionality.

With the fix the functionality is completely removed and directly integrated into the class where it is executed without the possibility to pass any parameter.

Solution

Option 1:

No action is needed when the user has no permission to execute development objects (authorization object = S_DEVELOP with fields OBJTYPE = CLAS and ACTVT = 16 ‘Execute’) through transactions SE24/SE80.

Option 2:

Implement the note with SNOTE to remove the coding. As the functionality is used for Post-Copy Automation (PCA) which is integated into SAP Basis for older releases/sps some dependent notes have to be implemented.

 

Available fix and Supported packages

SAP_BASIS|700|702|
SAP_BASIS|710|711|
SAP_BASIS|730|730|
SAP_BASIS|731|731|
SAP_BASIS|740|740|
SAP_BASIS|750|756|
 
Affected component

WPB_MANAGER

CVSS

CVSS v3.0 Base Score: 8,4 / 10 

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/3123196

TAGS

 

Command Injection, OS command injection, CVE-2021-44235