Advisory
On 11.07.2023 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within Kernel.
SAP Note 3233899 addresses "[CVE-2023-33987] Request smuggling and request concatenation vulnerability in SAP Web Dispatcher" to prevent http request smuggling with a high risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specification
SAP NetWeaver AS ABAP and SAP Web Dispatcher allow an unauthenticated attacker to submit maliciously crafted requests which may, over a number of attempts, result in a back-end server confusing the boundaries of malicious and legitimate messages resulting in the execution of malicious payloads.Solution
The requests are now properly handled by SAP application server (SAP Kernel) and SAP Web Dispatcher. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "Workaround can be applied without a restart but note that this workaround is a temporary fix and is not a permanent solution. SAP strongly recommends you apply the corrections outlined in the security note, which can be done instead of the workaround or after the workaround is implemented. Please refer for further information to the workaround instructions in the note.".
The advisory is valid for
- HDB 2.00 12
- KERNEL 7.49 23
- KERNEL 7.53 33
- KERNEL 7.54 12
- KERNEL 7.77 31
- KERNEL 7.81 24
- KERNEL 7.85 22
- KERNEL 7.88 5
- KERNEL 7.89 13
- KERNEL 7.90
- KRNL64NUC 7.49 24
- KRNL64UC 7.49 24
- KRNL64UC 7.53 33
- SAP_EXTENDED_APP_SERVICES 1 9
- WEBDISP 7.49 5
- WEBDISP 7.53 14
- WEBDISP 7.54 6
- WEBDISP 7.77 13
- WEBDISP 7.81 8
- WEBDISP 7.85 10
- WEBDISP 7.88
- WEBDISP 7.89 6
- WEBDISP 7.90
- XS_ADVANCED_RUNTIME 1.00 10
