CVE-2022-28773
📋 TL;DR
CVE-2022-28773 is an uncontrolled recursion vulnerability in SAP Web Dispatcher and SAP Internet Communication Manager that can cause a denial of service through application crashes. The affected components may restart automatically after crashing, but repeated exploitation could lead to service disruption. Organizations running vulnerable versions of SAP Web Dispatcher or SAP ICM are affected.
💻 Affected Systems
- SAP Web Dispatcher
- SAP Internet Communication Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Repeated exploitation causes sustained denial of service, preventing legitimate users from accessing SAP applications and disrupting business operations.
Likely Case
Intermittent service disruptions with automatic restarts, causing temporary availability issues and potential performance degradation.
If Mitigated
Minimal impact with proper network segmentation and monitoring; crashes would be detected and systems would automatically recover.
🎯 Exploit Status
The vulnerability can be triggered remotely without authentication, making it relatively easy to exploit for denial of service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3111293
Vendor Advisory: https://launchpad.support.sap.com/#/notes/3111293
Restart Required: Yes
Instructions:
1. Download SAP Note 3111293 from SAP Support Portal. 2. Apply the security patch following SAP standard patching procedures. 3. Restart the affected SAP Web Dispatcher or ICM services. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to SAP Web Dispatcher and ICM to trusted sources only
Load Balancer Configuration
allConfigure load balancers to detect and block malicious traffic patterns
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to SAP components
- Deploy monitoring and alerting for abnormal crash/restart patterns in SAP services
🔍 How to Verify
Check if Vulnerable:
Check if SAP Security Note 3111293 is applied using SAP Note Assistant or transaction SNOTECheck Version:
Check SAP system version using transaction SM51 or SM50Verify Fix Applied:
Verify SAP Note 3111293 is marked as implemented in transaction SNOTE and check system logs for successful patch application📡 Detection & Monitoring
Log Indicators:
- Frequent SAP Web Dispatcher/ICM crashes
- Automatic restart logs
- Stack overflow or recursion errors in system logs
Network Indicators:
- Unusual traffic patterns to SAP Web Dispatcher ports
- Multiple connection attempts triggering crashes
SIEM Query:
source="sap_system_logs" AND ("crash" OR "restart" OR "stack overflow") AND ("webdispatcher" OR "icm")