Connect with us

Hi, what are you looking for?



Details Disclosed for Critical SAP Vulnerabilities, Including Wormable Exploit Chain

Details have been disclosed for critical SAP vulnerabilities, including a wormable exploit chain, that can expose organizations to attacks.

A cybersecurity firm has disclosed the details of critical SAP vulnerabilities, including a wormable exploit chain, that can expose organizations to attacks. 

The vulnerabilities were reported to the enterprise software giant by Fabian Hagg, researcher at SEC Consult, an Austria-based cybersecurity consulting firm that is part of the Atos Group’s Eviden business. Hagg found the flaws as part of a research project that spanned three years, with patches being released by SAP in mid-2021 and January 2023

The vulnerabilities are tracked as CVE-2021-27610, CVE-2021-33677, CVE-2021-33684 and CVE-2023-0014, and they impact products that use the SAP Application Server for ABAP component. This includes SAP ERP Central Component (ECC), S/4HANA, BW/4HANA, Solution Manager (SolMan), SAP for Oil & Gas, SAP for Utilities, Supplier Relationship Management (SRM), Human Capital Management (HCM), and Employee Central Payroll (ECP) products. 

The issues, which include both design and implementation problems, were discovered during an analysis of the Remote Function Call (RFC) interface, which is designed for communication between SAP systems.

Two of the flaws have been assigned ‘critical’ severity ratings based on their CVSS score: CVE-2021-27610 and CVE-2023-0014

Exploitation of the vulnerabilities discovered by Hagg can lead to a full system compromise. The attacker only needs network access to the targeted system. 

Johannes Greil, head of the SEC Consult Vulnerability Lab, told SecurityWeek that the impacted systems are typically only reachable internally, but there may be certain products and configurations that could allow exploitation of the vulnerabilities directly from the internet. No user interaction or special permissions are required to exploit the flaws. 

Advertisement. Scroll to continue reading.

The vulnerabilities can be dangerous individually, but they pose an even greater risk when chained, making automated exploitation possible. The exploit chain was described as having wormable attack capabilities, enabling lateral movement in SAP environments. 

While patches have been released by the vendor, organizations need to ensure that they have installed the fixes. SEC Consult recommends prioritizing systems exposed to untrusted networks. In addition to patches, configuration changes and “complex system adjustments” are required to address one of the flaws, the security firm explained.

“In case patching is not an option, we advise to limit network-wise access (RFC/HTTP) to vulnerable servers as far as possible in order to minimize the available attack surface. Furthermore, we advise to fully enforce encrypted server-to-server communications by means of HTTPS and SNC. Lastly, please refer to the additional measures described by the vendor in the corresponding SAP notes and in the FAQ for Security Note 3089413,” SEC Consult said.

Details of the vulnerabilities, along with a deep dive into the RFC protocol, are available in a paper published by SEC Consult. The company has also published a blog post summarizing the findings

The research was also presented by Hagg on Thursday at the Troopers security conference in Germany. 

Related: SAP Vulnerability Exploited in Attacks After Details Disclosed at Hacker Conferences

Related: Threat Actors Quick to Target (Patched) SAP Vulnerabilities

Related: SAP Patches High-Severity Vulnerabilities With June 2023 Security Updates

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.