Advisory
On 13.07.2021 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within Kernel.
SAP Note 3000663 addresses "[CVE-2021-33683] HTTP Request Smuggling in SAP Web Dispatcher and Internet Communication Manager" to prevent http request smuggling with a medium risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specification
This note has been re-released with minor textual correction. The incorrect handling of the invalid Transfer-Encoding header leads to an HTTP Request Smuggling attack. This allows an attacker to bypass a web application firewalls or other restrictions, leading to an information disclosure.Solution
SAP Web Dispatcher, ICM and HANA Classic now properly handle invalid Transfer-Encoding headers Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "Make sure that no component vulnerable to CVE-2019-16869 or CVE-2020-7238 is behind the SAP Web Dispatcher.".
The advisory is valid for
- HDB 2.00 12
- KERNEL 7.21-7.22 5
- KERNEL 7.49 23
- KERNEL 7.53 33
- KERNEL 7.73 5
- KERNEL 7.77 31
- KERNEL 7.81 24
- KERNEL 7.82 2
- KERNEL 7.83 4
- KRNL32NUC 7.21 5
- KRNL32NUC 7.21EXT 5
- KRNL32UC 7.21 5
- KRNL32UC 7.21EXT 5
- KRNL64NUC 7.21 5
- KRNL64NUC 7.21EXT 5
- KRNL64NUC 7.22 27
- KRNL64NUC 7.22EXT 27
- KRNL64NUC 7.49 24
- KRNL64UC 7.21 5
- KRNL64UC 7.21EXT 5
- KRNL64UC 7.22 27
- KRNL64UC 7.22EXT 27
- KRNL64UC 7.49 24
- KRNL64UC 7.53 33
- KRNL64UC 7.73 5
- SAP_EXTENDED_APP_SERVICES 1 9
- WEBDISP 7.53 14
- WEBDISP 7.73
- WEBDISP 7.77 13
- WEBDISP 7.81 8
- WEBDISP 7.82
- WEBDISP 7.83
- XS_ADVANCED_RUNTIME 1.00 10
