CVE-2024-47594
📋 TL;DR
This CVE describes a cross-site scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal's KMC servlet where user inputs aren't properly encoded. Attackers can craft malicious links containing scripts that, when clicked by authenticated portal users, could compromise their browser sessions. This affects organizations running vulnerable versions of SAP NetWeaver Enterprise Portal.
💻 Affected Systems
- SAP NetWeaver Enterprise Portal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, hijack authenticated sessions, perform actions as the victim, and potentially access sensitive portal data.
Likely Case
Attackers would typically steal session cookies to impersonate users, potentially accessing their portal permissions and data.
If Mitigated
With proper input validation and output encoding, the attack would fail to execute malicious scripts.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into clicking malicious links; no authentication bypass needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check SAP Note 3503462 for specific patch versions
Vendor Advisory: https://me.sap.com/notes/3503462
Restart Required: Yes
Instructions:
1. Review SAP Note 3503462 for your specific SAP NetWeaver version
2. Apply the relevant SAP Security Patch Day updates
3. Restart the affected SAP systems
4. Verify the fix by testing the KMC servlet endpoints
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or input validation to sanitize KMC servlet parameters
Content Security Policy
allImplement strict CSP headers to prevent script execution from untrusted sources
🧯 If You Can't Patch
- Implement web application firewall with XSS protection rules
- Educate users about phishing risks and suspicious links
🔍 How to Verify
Check if Vulnerable:
Test KMC servlet endpoints with XSS payloads; check if scripts execute in victim contextCheck Version:
Check SAP system version via transaction SM51 or system infoVerify Fix Applied:
After patching, retest with XSS payloads to confirm scripts no longer execute📡 Detection & Monitoring
Log Indicators:
- Unusual parameter values in KMC servlet requests
- Multiple failed XSS attempts
Network Indicators:
- Requests to KMC endpoints with script tags or JavaScript in parameters
SIEM Query:
web_requests WHERE url CONTAINS 'kmc' AND (params CONTAINS '<script' OR params CONTAINS 'javascript:')