CVE-2021-33690: SAP NetWeaver NWDI SSRF Vulnerability

CVE-2021-33690 Overview

A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in the SAP NetWeaver Development Infrastructure (NWDI) Component Build Service. This vulnerability allows authenticated threat actors with server access to perform proxy attacks by sending crafted queries. Successful exploitation could lead to complete compromise of sensitive data residing on the server and significantly impact its availability.

The severity of this vulnerability is particularly dependent on the deployment context—organizations running SAP NWDI exposed to the internet face the highest risk, as reflected in the critical severity rating.

Critical Impact

Authenticated attackers can leverage SSRF to completely compromise sensitive data on the server and impact availability. The vulnerability is especially severe when SAP NWDI is internet-accessible.

Affected Products

• SAP NetWeaver Development Infrastructure 7.11
• SAP NetWeaver Development Infrastructure 7.20
• SAP NetWeaver Development Infrastructure 7.30
• SAP NetWeaver Development Infrastructure 7.31
• SAP NetWeaver Development Infrastructure 7.40
• SAP NetWeaver Development Infrastructure 7.50

Discovery Timeline

• September 15, 2021 - CVE-2021-33690 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-33690

Vulnerability Analysis

CVE-2021-33690 is classified as CWE-918 (Server-Side Request Forgery), a vulnerability class that allows attackers to induce server-side applications to make HTTP requests to arbitrary domains. In the context of SAP NetWeaver Development Infrastructure, the Build Service component fails to properly validate and sanitize user-supplied URL inputs before making server-side requests.

The vulnerability enables authenticated attackers to abuse the server as a proxy to reach internal resources that would otherwise be inaccessible from external networks. This can expose internal services, metadata endpoints, and sensitive configuration data. The scope change capability means successful exploitation can impact resources beyond the vulnerable component's security scope.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the SAP NetWeaver Development Infrastructure Build Service component. The application does not adequately verify or restrict the destination of server-side HTTP requests, allowing attackers to redirect these requests to arbitrary internal or external endpoints. This lack of proper URL validation enables the server to be weaponized as an SSRF proxy.

Attack Vector

The attack vector for CVE-2021-33690 requires network access and low-privilege authentication to the vulnerable SAP NetWeaver Development Infrastructure system. Once authenticated, a threat actor can craft malicious queries targeting the Build Service component. These queries manipulate the server into making requests to attacker-specified destinations, including:

• Internal network resources typically protected by firewalls
• Cloud metadata endpoints (e.g., AWS IMDSv1, Azure IMDS)
• Internal administrative interfaces
• Database servers and other backend services

The vulnerability is particularly dangerous in environments where SAP NWDI is exposed to the internet, as it provides a pivot point for attackers to explore and exploit internal infrastructure. The attacker does not require user interaction to exploit this vulnerability.

Detection Methods for CVE-2021-33690

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from SAP NetWeaver servers to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata endpoints
• Build Service log entries containing requests to non-standard or internal URLs
• Unexpected traffic patterns from the NWDI Build Service to internal services or external suspicious domains
• Authentication events followed by anomalous server-side request activity

Detection Strategies

• Implement network monitoring to identify server-initiated requests to internal network ranges or known metadata endpoints (e.g., 169.254.169.254)
• Deploy web application firewall (WAF) rules to detect and block SSRF patterns in requests to the Build Service
• Enable detailed audit logging on SAP NetWeaver systems and correlate with network traffic analysis
• Monitor for requests containing URL parameters pointing to internal resources or using file://, gopher://, or dict:// protocols

Monitoring Recommendations

• Configure SIEM rules to alert on SAP NetWeaver Build Service making requests to internal IP ranges or cloud metadata services
• Establish baseline network behavior for NWDI systems and alert on deviations
• Implement egress filtering and monitoring to detect unauthorized outbound connections from SAP servers

How to Mitigate CVE-2021-33690

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3072955 immediately
• Restrict network access to SAP NetWeaver Development Infrastructure systems to trusted networks only
• Ensure SAP NWDI is not directly exposed to the internet; place behind a VPN or other access control mechanism
• Review and audit authentication logs for any suspicious access patterns

Patch Information

SAP has released a security patch addressing CVE-2021-33690. Organizations should consult SAP Note #3072955 for detailed patching instructions and the SAP Security Advisory for additional context. It is critical to apply this patch to all affected versions (7.11, 7.20, 7.30, 7.31, 7.40, 7.50) of SAP NetWeaver Development Infrastructure.

Workarounds

• Implement network segmentation to isolate SAP NWDI systems from sensitive internal resources and the internet
• Deploy egress filtering rules on firewalls to prevent the SAP server from making requests to unauthorized internal or external destinations
• Use a reverse proxy or WAF with SSRF protection capabilities in front of the Build Service
• Disable or restrict access to the Build Service component if not required for business operations

# Example: Configure network-level egress restrictions (firewall rule concept)
# Block SAP NWDI server from accessing internal metadata endpoints
iptables -A OUTPUT -s <SAP_NWDI_SERVER_IP> -d 169.254.169.254 -j DROP

# Restrict outbound connections to only necessary destinations
iptables -A OUTPUT -s <SAP_NWDI_SERVER_IP> -m state --state NEW -j LOG --log-prefix "NWDI_EGRESS: "