CVE-2024-54197: SSRF in SAP NetWeaver Administrator(System Overview)

The SSRF vulnerability in SAP NetWeaver Administrator(System Overview) enables an attacker, once authenticated, to craft HTTP requests that the system will execute on their behalf. This allows the attacker to discover internal HTTP endpoints that are not directly accessible from the outside world. While the vulnerability’s impact on availability is minimal, the enumeration of internal services can expose sensitive information or provide a stepping stone for further attacks. An attacker could potentially leverage this to access internal resources, read sensitive configuration files, or even trigger actions on other internal systems, depending on the exposed endpoints and their functionality. The potential for data exfiltration and lateral movement should be carefully considered.

1. Reserved2024-12-02
2. Published2024-12-10
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-54197 is to upgrade SAP NetWeaver Administrator(System Overview) to version 7.50.1 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting outbound network access for the NetWeaver Administrator component using firewalls or network segmentation. Web Application Firewalls (WAFs) configured to detect and block SSRF attempts can also provide a layer of defense. Monitor SAP system logs for unusual HTTP requests originating from the NetWeaver Administrator component. After upgrading, verify the fix by attempting to enumerate internal HTTP endpoints using the same crafted requests that trigger the vulnerability; successful enumeration should no longer be possible.