CVE-2024-34683
📋 TL;DR
An authenticated attacker can upload malicious files to the SAP Document Builder service, which when accessed by a victim allows the attacker to access, modify, or make information unavailable in the victim's browser. This affects SAP systems running vulnerable versions of the Document Builder service with authenticated users.
💻 Affected Systems
- SAP Document Builder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal sensitive business documents, modify critical information, or disrupt business operations by making documents unavailable.
Likely Case
Data theft or manipulation of business documents through targeted attacks against specific users.
If Mitigated
Limited impact with proper file upload restrictions and user access controls in place.
🎯 Exploit Status
Requires attacker to have valid credentials and ability to upload files that victims will access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3459379
Vendor Advisory: https://me.sap.com/notes/3459379
Restart Required: Yes
Instructions:
1. Download SAP Note 3459379 from SAP Support Portal. 2. Apply the security patch to affected SAP Document Builder installations. 3. Restart the affected services.
🔧 Temporary Workarounds
Restrict File Uploads
allImplement strict file upload controls and validation in SAP Document Builder
Access Control Enhancement
allImplement additional authentication checks and user session validation
🧯 If You Can't Patch
- Implement strict file upload validation and whitelist allowed file types
- Monitor and audit all file upload activities in SAP Document Builder
🔍 How to Verify
Check if Vulnerable:
Check if SAP Security Note 3459379 is applied in your SAP system using transaction SNOTECheck Version:
Check SAP system version and applied notes using transaction SM51 or SM50Verify Fix Applied:
Verify SAP Note 3459379 is successfully implemented and no errors in application logs📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Multiple failed upload attempts
- Access to uploaded files from unexpected IPs
Network Indicators:
- Unusual traffic to SAP Document Builder endpoints
- File upload requests with suspicious content
SIEM Query:
source="sap_logs" AND (event="file_upload" OR event="document_access") AND user!="*expected_users*"