CVE-2024-24743
📋 TL;DR
CVE-2024-24743 is an XML external entity (XXE) vulnerability in SAP NetWeaver AS Java's Guided Procedures component. Unauthenticated attackers can submit malicious XML files to access sensitive files and data without modification. This affects SAP NetWeaver AS Java version 7.50.
💻 Affected Systems
- SAP NetWeaver AS Java
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive configuration files, user data, or system files, potentially leading to credential theft, data exfiltration, or reconnaissance for further attacks.
Likely Case
Unauthenticated attackers reading application configuration files, potentially exposing database credentials, API keys, or other sensitive information.
If Mitigated
With proper network segmentation and access controls, impact is limited to reading non-critical files within the application context.
🎯 Exploit Status
XXE vulnerabilities typically have low exploitation complexity. The description indicates unauthenticated network access is sufficient.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3426111
Vendor Advisory: https://me.sap.com/notes/3426111
Restart Required: Yes
Instructions:
1. Download SAP Note 3426111 from SAP Support Portal. 2. Apply the patch to affected SAP NetWeaver AS Java systems. 3. Restart the SAP system to activate the fix.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to SAP NetWeaver AS Java endpoints to trusted sources only
XML Parser Hardening
allConfigure XML parsers to disable external entity processing if possible
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SAP systems from untrusted networks
- Deploy web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check if SAP NetWeaver AS Java version 7.50 is running without SAP Note 3426111 appliedCheck Version:
In SAP GUI: System → Status → Component versionVerify Fix Applied:
Verify SAP Note 3426111 is applied in transaction SNOTE and system is restarted📡 Detection & Monitoring
Log Indicators:
- Unusual XML file uploads to Guided Procedures endpoints
- Multiple failed XML parsing attempts
Network Indicators:
- HTTP requests with XML content to /CAF/GuidedProcedures endpoints
- Unusual file read patterns from application server
SIEM Query:
source="sap_netweaver" AND (uri_path="/CAF/GuidedProcedures/*" AND content_type="application/xml")