PT-2022-3187 · Sap · Krnl64Uc+4

Fabian Hagg · Published 2022-03-23 · Updated 2022-10-27 · CVE-2022-27668

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver and ABAP Platform versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP ROUTER 7.53, 7.22

Description The issue is related to errors in authorization in the saprouttab file, which can allow an unauthenticated attacker to execute SAProuter administration commands remotely. This could highly impact system availability, for example, by stopping the SAProuter.

Recommendations For versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, consider restricting access to the saprouttab file to prevent unauthorized modifications. For versions KRNL64NUC 7.49, KRNL64UC 7.49, review the configuration of the route permission table to ensure proper authorization. For versions SAP ROUTER 7.53, 7.22, limit remote access to SAProuter administration commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-03868

CVE-2022-27668

Affected Products

Abap Platform

Kernel

Krnl64Uc

Sap Netweaver

Saprouter

References · 9

• 🔥 http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2022/Sep/17 · Exploit
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27668 · Security Note
• https://bdu.fstec.ru/vul/2022-03868 · Security Note
• https://launchpad.support.sap.com/#/notes/3158375 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27668 · Vendor Advisory
• https://vuldb.com/ru/?id.201924 · Note
• https://t.me/cvenotify/36309 · Telegram Post