CVE-2024-34688
📋 TL;DR
This vulnerability in SAP NetWeaver AS Java allows attackers to perform denial-of-service attacks by exploiting unrestricted access to Meta Model Repository services. This affects all SAP NetWeaver AS Java systems with vulnerable configurations, potentially disrupting legitimate user access to business applications.
💻 Affected Systems
- SAP NetWeaver AS Java
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete application unavailability for extended periods, disrupting critical business operations dependent on SAP systems.
Likely Case
Intermittent service degradation or temporary unavailability affecting user productivity and business processes.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting attack surface.
🎯 Exploit Status
Attack requires network access to vulnerable services but no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply SAP Security Note 3460407
Vendor Advisory: https://me.sap.com/notes/3460407
Restart Required: Yes
Instructions:
1. Download SAP Note 3460407 from SAP Support Portal. 2. Apply the security patch following SAP's standard patching procedures. 3. Restart the SAP NetWeaver AS Java system.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Meta Model Repository services using firewall rules
Service Disablement
allDisable Meta Model Repository services if not required for business operations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SAP systems from untrusted networks
- Deploy web application firewall with DoS protection rules
🔍 How to Verify
Check if Vulnerable:
Check if SAP Security Note 3460407 is applied via SAP transaction SNOTECheck Version:
Check SAP system version via SAP GUI or transaction SM51Verify Fix Applied:
Verify patch application in SAP system and test Meta Model Repository service accessibility📡 Detection & Monitoring
Log Indicators:
- Unusual high volume of requests to Meta Model Repository services
- System performance degradation logs
- Connection timeout errors
Network Indicators:
- High volume of traffic to SAP Java ports (typically 5XX00 range)
- Unusual request patterns to /sap/bc/ repositories
SIEM Query:
source="sap_java_logs" AND ("Meta Model" OR "repository") AND (request_count > threshold)