CVE-2022-28772
📋 TL;DR
CVE-2022-28772 is a stack-based buffer overflow vulnerability in SAP Web Dispatcher and Internet Communication Manager. Attackers can send overlong input values to overwrite the program stack, causing denial of service. Organizations running affected SAP versions are vulnerable.
💻 Affected Systems
- SAP Web Dispatcher
- SAP Internet Communication Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of SAP Web Dispatcher or ICM, potentially affecting all SAP applications behind these components, with possible remote code execution if stack corruption leads to arbitrary code execution.
Likely Case
Denial of service causing SAP Web Dispatcher or ICM to crash, making SAP applications unavailable until services are restarted.
If Mitigated
Limited impact with proper network segmentation and input validation controls in place, potentially preventing exploitation attempts from reaching vulnerable components.
🎯 Exploit Status
Exploitation requires sending specially crafted overlong input values to vulnerable components. No authentication is required if the vulnerable service is network-accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3111311 patches
Vendor Advisory: https://launchpad.support.sap.com/#/notes/3111311
Restart Required: Yes
Instructions:
1. Download and apply SAP Security Note 3111311 patches from SAP Support Portal. 2. Apply patches to affected SAP Web Dispatcher and ICM installations. 3. Restart SAP Web Dispatcher and ICM services. 4. Verify patch application by checking version information.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to SAP Web Dispatcher and ICM components to trusted sources only
Input Validation
allImplement additional input validation and length checking at network perimeter devices
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure of SAP Web Dispatcher and ICM to only necessary trusted sources
- Deploy web application firewalls or intrusion prevention systems with rules to detect and block overlong input attempts
🔍 How to Verify
Check if Vulnerable:
Check SAP kernel and Web Dispatcher versions against affected version lists. Use SAP transaction SM51 to view system information.Check Version:
On SAP system: Execute 'disp+work' command or check via SAP GUI transaction SM51Verify Fix Applied:
Verify SAP Security Note 3111311 is applied by checking SAP Note application status or confirming kernel version is updated beyond affected versions.📡 Detection & Monitoring
Log Indicators:
- SAP Web Dispatcher or ICM crash logs
- Abnormal termination messages in SAP system logs
- Error messages related to buffer overflow or stack corruption
Network Indicators:
- Unusually large HTTP/SOAP requests to SAP Web Dispatcher
- Multiple connection attempts with overlong parameter values
- Sudden service unavailability patterns
SIEM Query:
source="sap_logs" AND ("Web Dispatcher crash" OR "ICM terminated" OR "buffer overflow")