Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)

The SSRF vulnerability in SAP NetWeaver Administrator(System Overview) enables an attacker, once authenticated, to craft HTTP requests that the system will execute on their behalf. This allows the attacker to discover internal HTTP endpoints that are not directly accessible from the outside world. While the vulnerability’s impact on availability is minimal, the enumeration of internal services can expose sensitive information or provide a stepping stone for further attacks. An attacker could potentially leverage this to access internal resources, read sensitive configuration files, or even trigger actions on other internal systems, depending on the exposed endpoints and their functionality. The potential for data exfiltration and lateral movement should be carefully considered.

Organizations heavily reliant on SAP NetWeaver for critical business processes are at significant risk. Specifically, environments with limited network segmentation or overly permissive firewall rules are more vulnerable. Those using older, unsupported versions of SAP NetWeaver Administrator(System Overview) are also at increased risk due to the lack of security updates.

• linux / server:

journalctl -u sapstartsrv -g "HTTP request"

• sap: Review SAP system logs for unusual HTTP requests originating from the NetWeaver Administrator component, specifically looking for requests to internal IP addresses or unusual hostnames. • generic web: Use curl to probe for internal endpoints. For example, curl -v http://<NetWeaverAdminIP>/<potentialinternalendpoint> and analyze the response headers and body for signs of internal resource exposure.

1. 2024-12-10Disclosure

   disclosure

1. Reserviert2024-12-02
2. Veröffentlicht2024-12-10
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-54197 is to upgrade SAP NetWeaver Administrator(System Overview) to version 7.50.1 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting outbound network access for the NetWeaver Administrator component using firewalls or network segmentation. Web Application Firewalls (WAFs) configured to detect and block SSRF attempts can also provide a layer of defense. Monitor SAP system logs for unusual HTTP requests originating from the NetWeaver Administrator component. After upgrading, verify the fix by attempting to enumerate internal HTTP endpoints using the same crafted requests that trigger the vulnerability; successful enumeration should no longer be possible.