CVE-2022-22536: SAP Patches Internet Communication Manager Advanced Desync (ICMAD) Vulnerabilities
SAP and Onapsis Research Labs collaborate to disclose three critical vulnerabilities impacting SAP NetWeaver Application Servers. The most severe of the three could lead to full system takeover.
Background
On February 8, SAP disclosed several vulnerabilities in the Internet Communication Manager (ICM), a critical component of its NetWeaver Application Servers in coordination with security researchers at Onapsis who discovered the flaws. SAP and Onapsis have both released write-ups regarding their partnership to discover and patch these flaws. The Cybersecurity and Infrastructure Security Agency also issued an immediate warning about these vulnerabilities, stating that exploitation could result in disrupted operations, data theft, fraud and ransomware attacks.
SAP Netweaver is an application and integration server that acts as the software stack for most of SAP’s applications, including solutions for critical business functions such as enterprise resource planning, customer relationship management and supply chain management.
Analysis
Onapsis Research Labs discovered three critical vulnerabilities in the ICM component of SAP applications. According to the Onapsis Threat Report, the vulnerable ICM component is “present in most SAP products and is a critical part of the overall SAP technology stack,” making these vulnerabilities a major concern for enterprises that deploy SAP products. Because this component connects SAP applications to the internet, it is exposed by default in most deployments.
CVE-2022-22536 is a memory pipes (MPI) desynchronization vulnerability that received the highest CVSSv3 score of 10.0. Onapsis has named this flaw ICMAD for Internet Communication Manager Advanced Desync. An unauthenticated remote attacker could exploit the vulnerability using a simple HTTP request and achieve full system takeover. In addition to being the most critical, CVE-2022-22536 also has the widest effect of all three vulnerabilities, impacting SAP NetWeaver Java or ABAP applications with default configurations.
CVE-2022-22532 is a HTTP request smuggling vulnerability according to SAP in the ICM component. However, Onapsis lists it as a use after free vulnerability. This vulnerability only exists in SAP NetWeaver Java systems. It received a CVSSv3 score of 8.1 and does not require authentication or user interaction to exploit. According to the Onapsis report, certain “more complex [exploit] scenarios” could lead to remote code execution.
CVE-2022-22533 is a memory leak in memory pipe management that could lead to denial of service. It also only affects SAP Application Server Java systems and received a CVSSv3 score of 7.5. An attacker could exploit this flaw using specially crafted HTTP(S) requests to consume all MPI resources.
Proof of concept
Onapsis Research Labs published a scanner script on GitHub for organizations to detect if their SAP instances are vulnerable to CVE-2022-22536. The readme file for the scanner does caution that this script is a best effort attempt at identifying vulnerable instances and cannot provide 100% accuracy.
Solution
As part of its monthly Security Patch Day, SAP published HotNews Security Notes 3123396 and 3123427 (login required) to address CVE-2022-22536 and CVE-2022-22532. The table below lists the SAP products patched. CVE-2022-22533 is not currently listed on the February 2022 Patch Day page.
| CVE | Description | Products |
|---|---|---|
| CVE-2022-22536 | Memory Pipe Desynchronization | SAP Web Dispatcher, Versions: 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87 SAP Content Server, Version: 7.53 SAP NetWeaver and ABAP Platform, Version: KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49 |
| CVE-2022-22532 | HTTP Request Smuggling/Use After Free | SAP NetWeaver Application Server Java, Versions: KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53 |
Identifying affected systems
A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
Cybersecurity Snapshot: Study Raises Open Source Security Red Flags, as Cyber Agencies Offer Prevention Tips Against Telecom Spying Attacks
December 6, 2024Don’t miss the Linux Foundation’s deep dive into open source software security. Plus, cyber agencies warn about China-backed cyber espionage campaign targeting telecom data. Meanwhile, a study shows the weight of security considerations in generative AI projects. And get the latest on ransomware trends, financial cybercrime and critical infrastructure security.
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.
- Risk-based Vulnerability Management
- Vulnerability Management
- Vulnerability Scanning