HTTP request smuggling in SAP NetWeaver

1) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU78958

Risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2022-22536

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can prepend a victim's request with arbitrary data and execute functions impersonating the victim or poison intermediary Web caches.

Successful exploitation of the vulnerability can result in full system compromise.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SAP NetWeaver AS ABAP: 753

SAP NetWeaver AS JAVA: 7.53

SAP Content Server: 7.53

SAP Web Dispatcher WEBDISP: 7.53

CPE2.3

• cpe:2.3:a:sap:sap_netweaver_as_abap:753:*:*:*:*:*:*:*
• cpe:2.3:a:sap:netweaver_as_java:7.53:*:*:*:*:*:*:*
• cpe:2.3:a:sap:sap_content_server:7.53:*:*:*:*:*:*:*
• cpe:2.3:a:sap:sap_web_dispatcher_webdisp:7.53:*:*:*:*:*:*:*

External links

https://launchpad.support.sap.com/#/notes/3123396
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.