CVE-2022-22536: SAP Patches Internet Communication Manager Advanced Desync (ICMAD) Vulnerabilities
SAP and Onapsis Research Labs collaborate to disclose three critical vulnerabilities impacting SAP NetWeaver Application Servers. The most severe of the three could lead to full system takeover.
Background
On February 8, SAP disclosed several vulnerabilities in the Internet Communication Manager (ICM), a critical component of its NetWeaver Application Servers in coordination with security researchers at Onapsis who discovered the flaws. SAP and Onapsis have both released write-ups regarding their partnership to discover and patch these flaws. The Cybersecurity and Infrastructure Security Agency also issued an immediate warning about these vulnerabilities, stating that exploitation could result in disrupted operations, data theft, fraud and ransomware attacks.
SAP Netweaver is an application and integration server that acts as the software stack for most of SAP’s applications, including solutions for critical business functions such as enterprise resource planning, customer relationship management and supply chain management.
Analysis
Onapsis Research Labs discovered three critical vulnerabilities in the ICM component of SAP applications. According to the Onapsis Threat Report, the vulnerable ICM component is “present in most SAP products and is a critical part of the overall SAP technology stack,” making these vulnerabilities a major concern for enterprises that deploy SAP products. Because this component connects SAP applications to the internet, it is exposed by default in most deployments.
CVE-2022-22536 is a memory pipes (MPI) desynchronization vulnerability that received the highest CVSSv3 score of 10.0. Onapsis has named this flaw ICMAD for Internet Communication Manager Advanced Desync. An unauthenticated remote attacker could exploit the vulnerability using a simple HTTP request and achieve full system takeover. In addition to being the most critical, CVE-2022-22536 also has the widest effect of all three vulnerabilities, impacting SAP NetWeaver Java or ABAP applications with default configurations.
CVE-2022-22532 is a HTTP request smuggling vulnerability according to SAP in the ICM component. However, Onapsis lists it as a use after free vulnerability. This vulnerability only exists in SAP NetWeaver Java systems. It received a CVSSv3 score of 8.1 and does not require authentication or user interaction to exploit. According to the Onapsis report, certain “more complex [exploit] scenarios” could lead to remote code execution.
CVE-2022-22533 is a memory leak in memory pipe management that could lead to denial of service. It also only affects SAP Application Server Java systems and received a CVSSv3 score of 7.5. An attacker could exploit this flaw using specially crafted HTTP(S) requests to consume all MPI resources.
Proof of concept
Onapsis Research Labs published a scanner script on GitHub for organizations to detect if their SAP instances are vulnerable to CVE-2022-22536. The readme file for the scanner does caution that this script is a best effort attempt at identifying vulnerable instances and cannot provide 100% accuracy.
Solution
As part of its monthly Security Patch Day, SAP published HotNews Security Notes 3123396 and 3123427 (login required) to address CVE-2022-22536 and CVE-2022-22532. The table below lists the SAP products patched. CVE-2022-22533 is not currently listed on the February 2022 Patch Day page.
| CVE | Description | Products |
|---|---|---|
| CVE-2022-22536 | Memory Pipe Desynchronization | SAP Web Dispatcher, Versions: 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87 SAP Content Server, Version: 7.53 SAP NetWeaver and ABAP Platform, Version: KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49 |
| CVE-2022-22532 | HTTP Request Smuggling/Use After Free | SAP NetWeaver Application Server Java, Versions: KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53 |
Identifying affected systems
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Context Is King: From Vulnerability Management to Exposure Management
November 7, 2024Vulnerability management remains a cornerstone of preventive cybersecurity, but organizations still struggle with vulnerability overload and sophisticated threats. Tenable’s new Exposure Signals gives security teams comprehensive context, so they can shift from vulnerability management to exposure management and effectively prioritize high-risk exposures across their complex attack surface.
Cybersecurity Snapshot: New Guides Offer Best Practices for Preventing Shadow AI and for Deploying Secure Software Updates
October 25, 2024Looking for help with shadow AI? Want to boost your software updates’ safety? New publications offer valuable tips. Plus, learn why GenAI and data security have become top drivers of cyber strategies. And get the latest on the top “no-nos” for software security; the EU’s new cyber law; and CISOs’ communications with boards.
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
- Risk-based Vulnerability Management
- Vulnerability Management
- Vulnerability Scanning