CVE-2021-21481: SAP NetWeaver Auth Bypass Vulnerability

CVE-2021-21481 Overview

CVE-2021-21481 is a missing authorization vulnerability [CWE-863] in the MigrationService component of SAP NetWeaver. The service does not perform an authorization check before granting access to configuration objects. An unauthenticated attacker on an adjacent network can reach configuration objects, including those that grant administrative privileges. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected SAP system.

Critical Impact
An adjacent-network attacker can obtain administrative privileges on SAP NetWeaver Java stacks without authentication, leading to full system takeover.

Affected Products

SAP NetWeaver 7.10 and 7.11
SAP NetWeaver 7.20, 7.30, and 7.31
SAP NetWeaver 7.40 and 7.50

Discovery Timeline

2021-03-09 - CVE-2021-21481 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2021-21481

Vulnerability Analysis

The MigrationService is a component shipped with SAP NetWeaver Application Server Java. It is intended to support migration of configuration data between Java stack instances. The service exposes operations that read and modify configuration objects stored in the NetWeaver configuration database.

The vulnerability stems from a missing authorization check on the service interface. Requests reaching the MigrationService are processed without verifying whether the caller holds the required privileges. As a result, any actor who can route traffic to the service port can invoke its operations.

Because configuration objects include credentials, role bindings, and trust configurations, an attacker can escalate to administrative privileges on the Java stack. From an administrative position on NetWeaver, an attacker can deploy arbitrary Java applications, modify system properties, and pivot into connected SAP systems.

Root Cause

The root cause is improper access control [CWE-863]. The MigrationService endpoint relies on network reachability as an implicit trust boundary instead of enforcing an authenticated, authorized invocation context. No role check is performed against the caller before configuration objects are returned or modified.

Attack Vector

Exploitation requires adjacent-network access to the SAP NetWeaver Java instance. The attacker sends crafted requests to the MigrationService interface to enumerate and retrieve configuration objects. Because no user interaction or prior credentials are required, the attack chain is short and reliable against unpatched systems. Refer to SAP Note #3022422 and the SAP Wiki Page Overview for vendor-supplied technical details.

Detection Methods for CVE-2021-21481

Indicators of Compromise

Unexpected HTTP or RMI requests to MigrationService endpoints from non-administrative hosts or subnets.
New or modified configuration objects in the NetWeaver Java configuration database without a corresponding change ticket.
Creation of administrative users or role assignments in the Java User Management Engine (UME) outside of approved change windows.
Deployment of unfamiliar Java applications or .ear/.sda archives on the NetWeaver Application Server.

Detection Strategies

Inspect SAP NetWeaver Java HTTP access logs and defaultTrace files for invocations referencing MigrationService from unauthenticated sessions.
Correlate configuration store changes with authenticated administrator activity in the Java UME audit log.
Baseline expected administrative source IPs and alert on MigrationService requests originating outside that baseline.

Monitoring Recommendations

Forward SAP Security Audit Log and Java defaultTrace data to a centralized SIEM or data lake for correlation.
Monitor north-south and east-west traffic to NetWeaver management ports for unauthenticated administrative service calls.
Track privilege changes for accounts in the Administrator role group within the Java UME.

How to Mitigate CVE-2021-21481

Immediate Actions Required

Apply the patches referenced in SAP Note #3022422 to every NetWeaver 7.10 through 7.50 instance.
Restrict network access to NetWeaver Java administrative ports to a dedicated management network or jump hosts.
Audit the Java UME for unauthorized administrative accounts and role assignments created since the affected service was exposed.

Patch Information

SAP released a corrective patch documented in SAP Note #3022422, which adds the missing authorization check to the MigrationService. The SAP Wiki Page Overview lists the supported Support Package and patch levels per NetWeaver release. Administrators should validate that the patch is applied across all Java application server nodes, not only the central instance.

Workarounds

Block external access to the MigrationService URL paths at the SAP Web Dispatcher or upstream reverse proxy until patching is complete.
Disable or undeploy the MigrationService component on systems where migration functionality is not required.
Enforce network segmentation so that only authorized administrative subnets can reach NetWeaver Java management interfaces.

bash

# SAP Web Dispatcher rule to block external access to MigrationService
# Place in the permission table (icm/HTTP/auth_<xx>) configuration
if %{PATH} stricmp /MigrationService [OR]
if %{PATH} regimatch ^/MigrationService(/.*)?$
  Deny