SAP's November patches: four flaws that need no password

SAP fixed four flaws this month that let a stranger take over an SAP system without a password. They sit in the parts that face the network: the web front door, the gateway other systems talk to, and single sign-on. Patch the kernel and every Web Dispatcher now, and lock down the gateway's proxy list before you wait for a maintenance window.

An SAP system holds the ledger, the vendor bank details and the customer master. Whoever controls it can read or change any of that, quietly. Researchers at Onapsis, who found three of the four 10.0 flaws, say their exploits run commands as <sid>adm, the operating system account that owns the SAP installation. From there the database password and the stored connections to other systems are in reach.

Nothing from this month is known to be under attack. CISA's catalog of exploited bugs had none of these as of November 13, and Onapsis says it hasn't seen attacks. That's the good news, and it may not last. In August a critical SAP Commerce Cloud flaw drew attacks within days of its fix, according to threat-intelligence firm Defused, and SAP already has 14 entries on CISA's list.

Three of the four bugs also need nothing unusual switched on. WebSocket support is enabled by default in the web component and the Web DispatcherdefinitionSAP's own reverse proxy. Many companies put it at the network edge so Fiori and API traffic goes through it before reaching the SAP system., and the gateway's proxy setting ships in allow-all mode for backward compatibility. A system nobody has touched in years can be exposed exactly as it was installed.

The awkward part for Basis teams is where the hole sits. Most gateway hardening guidance covers two lists, secinfo and reginfo, and Onapsis says neither one stops this attack. The list that matters is prxyinfodefinitionThe SAP Gateway's proxy access list. It decides which connections the gateway may relay or open for a client. If it's missing, the gw/acl_mode_proxy setting decides., the one fewest reviews ever open. A gateway that passed last year's audit can still be wide open here.

The SAML2definitionSingle sign-on for SAP, usually through Entra ID or Okta. The identity provider signs each sign-in, and SAP is meant to check that signature every time. flaw is the one identity teams should read twice. Single sign-on moves trust from the password to the identity provider's signature on each sign-in. If the system doesn't check that signature, anyone who can reach the sign-in endpoint can write their own. SAP's own CVE description says the attacker can impersonate arbitrary users, privileged accounts included, and the damage can spread to connected systems.

SAP lists 16 affected SAP_BASIS releases, from 702 up to 922, so age won't get a system off the list. The trigger is configuration. RedRays, a firm that reviewed the gated notes, treats any ABAP system that uses SAML2 for browser sign-in as in scope until someone proves otherwise, and plenty of Fiori systems do. It also gives a quick test: if the system answers a request for its SAML2 service-provider metadata, SAML2 is on for that client.

ICM2SHELL, Onapsis's name for the WebSocket bug, has two traps. On kernel 7.93, a higher patch level isn't always a fixed one: patch level 419 is still vulnerable, while the updated 401 stack kernel and 420 or later carry the fix. Kernel releases that are out of maintenance, such as 7.49, 7.73 and 7.89, are affected too and may not get a fix, so those systems need a kernel upgrade.

PROXYGATE has the subtlest fix. On kernels 7.93 and 9.16 the setting already exists, and the fix is to set gw/acl_mode_proxy to 1. Kernels 7.22, 7.53, 7.54, 7.77 and 8.04 only gain that setting with the November kernel patch. Onapsis is blunt about it: installing the patch without a restrictive prxyinfo file or the parameter set to 1 leaves the system in scope.

Most of this month's work is one kernel rollout. RedRays counts 17 of the November fixes in the kernel, the standalone Web Dispatcher or both, so the sensible move is a single update that covers them all instead of one patch per note. The SAML2 fix is the exception: it's an ABAP correction, delivered through the note's correction instructions or a support package.

# Does this client answer as a SAML2 service provider? XML back means SAML2 is on
$ curl -s "https://<host>:<port>/sap/saml2/sp/metadata?sap-client=100" | head -c 200
# Look up where the proxy list lives (profile parameter gw/prxy_info), then open it
$ cat <path from gw/prxy_info>
P SOURCE=* DEST=*
# That wildcard line means exposed at any patch level

All four 10.0s sit in components that answer network traffic, and often more networks can reach them than need to. This month 17 of the fixes sit in the kernel or the Web Dispatcher alone. Shrinking who can reach those pieces helps every month, whatever the next bug turns out to be.

Our SAP Basis and security engineers can build the kernel, Web Dispatcher and gateway inventory with your team, plan one rollout that covers the November notes and review the SAML2 trust lists with your identity team. The SAP S/4HANA page explains how we work on S/4HANA and ECC, you can bring in SAP engineers for the patch window, or start with an assessment of what your landscape exposes. Two of SAP's out-of-band notes since October's Patch Day cover flaws we've already explained: the Brotli decoder bug and the PHP and Node.js releases.