CVE-2022-22536: SAP Patches Internet Communication Manager Advanced Desync (ICMAD) Vulnerabilities
SAP and Onapsis Research Labs collaborate to disclose three critical vulnerabilities impacting SAP NetWeaver Application Servers. The most severe of the three could lead to full system takeover.
Background
On February 8, SAP disclosed several vulnerabilities in the Internet Communication Manager (ICM), a critical component of its NetWeaver Application Servers in coordination with security researchers at Onapsis who discovered the flaws. SAP and Onapsis have both released write-ups regarding their partnership to discover and patch these flaws. The Cybersecurity and Infrastructure Security Agency also issued an immediate warning about these vulnerabilities, stating that exploitation could result in disrupted operations, data theft, fraud and ransomware attacks.
SAP Netweaver is an application and integration server that acts as the software stack for most of SAP’s applications, including solutions for critical business functions such as enterprise resource planning, customer relationship management and supply chain management.
Analysis
Onapsis Research Labs discovered three critical vulnerabilities in the ICM component of SAP applications. According to the Onapsis Threat Report, the vulnerable ICM component is “present in most SAP products and is a critical part of the overall SAP technology stack,” making these vulnerabilities a major concern for enterprises that deploy SAP products. Because this component connects SAP applications to the internet, it is exposed by default in most deployments.
CVE-2022-22536 is a memory pipes (MPI) desynchronization vulnerability that received the highest CVSSv3 score of 10.0. Onapsis has named this flaw ICMAD for Internet Communication Manager Advanced Desync. An unauthenticated remote attacker could exploit the vulnerability using a simple HTTP request and achieve full system takeover. In addition to being the most critical, CVE-2022-22536 also has the widest effect of all three vulnerabilities, impacting SAP NetWeaver Java or ABAP applications with default configurations.
CVE-2022-22532 is a HTTP request smuggling vulnerability according to SAP in the ICM component. However, Onapsis lists it as a use after free vulnerability. This vulnerability only exists in SAP NetWeaver Java systems. It received a CVSSv3 score of 8.1 and does not require authentication or user interaction to exploit. According to the Onapsis report, certain “more complex [exploit] scenarios” could lead to remote code execution.
CVE-2022-22533 is a memory leak in memory pipe management that could lead to denial of service. It also only affects SAP Application Server Java systems and received a CVSSv3 score of 7.5. An attacker could exploit this flaw using specially crafted HTTP(S) requests to consume all MPI resources.
Proof of concept
Onapsis Research Labs published a scanner script on GitHub for organizations to detect if their SAP instances are vulnerable to CVE-2022-22536. The readme file for the scanner does caution that this script is a best effort attempt at identifying vulnerable instances and cannot provide 100% accuracy.
Solution
As part of its monthly Security Patch Day, SAP published HotNews Security Notes 3123396 and 3123427 (login required) to address CVE-2022-22536 and CVE-2022-22532. The table below lists the SAP products patched. CVE-2022-22533 is not currently listed on the February 2022 Patch Day page.
| CVE | Description | Products |
|---|---|---|
| CVE-2022-22536 | Memory Pipe Desynchronization | SAP Web Dispatcher, Versions: 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87 SAP Content Server, Version: 7.53 SAP NetWeaver and ABAP Platform, Version: KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49 |
| CVE-2022-22532 | HTTP Request Smuggling/Use After Free | SAP NetWeaver Application Server Java, Versions: KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53 |
Identifying affected systems
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
Cybersecurity Snapshot: CSRB Calls Exchange Online Hack “Preventable,” While CISA, Others Warn About XZ Utils Backdoor Vulnerability
April 5, 2024Check out why the Cyber Safety Review Board has concluded that the Microsoft Exchange Online breach “should never have occurred.” Plus, warnings about the supply chain attack against the XZ Utils open source utility are flying. In addition, a report says ransomware attacks surged in February. And the U.S. government issues a comprehensive AI usage policy for federal agencies. And much more!
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
Oracle April 2024 Critical Patch Update Addresses 239 CVEs
April 17, 2024Oracle addresses 239 CVEs in its second quarterly update of 2024 with 441 patches, including 38 critical updates.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
- Risk-based Vulnerability Management
- Vulnerability Management
- Vulnerability Scanning