CVE-2022-24396: SAP Simple Diagnostics Agent Auth Bypass

CVE-2022-24396 Overview

CVE-2022-24396 is a missing authentication vulnerability affecting SAP Simple Diagnostics Agent versions 1.0 through 1.57. The agent fails to perform any authentication checks for functionalities accessible via localhost on HTTP port 3005. This authentication bypass allows attackers with local access to reach administrative and privileged functionalities, enabling them to read, modify, or delete sensitive information and configurations.

Critical Impact

Local attackers can access administrative functionalities without authentication, potentially compromising system configurations and sensitive data on SAP environments.

Affected Products

• SAP Simple Diagnostics Agent versions 1.0 up to 1.57
• SAP FRUN (Focused Run) environments utilizing Simple Diagnostics Agent

Discovery Timeline

• March 10, 2022 - CVE-2022-24396 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-24396

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The SAP Simple Diagnostics Agent exposes an HTTP service on port 3005 that binds to localhost. While binding to localhost provides some network isolation, the service lacks proper authentication mechanisms for its administrative endpoints.

The absence of authentication controls means that any user or process with local access to the system can interact with the agent's API endpoints without credentials. This design flaw enables unauthorized access to privileged operations including configuration management, diagnostic data retrieval, and system modification capabilities.

The attack requires local access (either through legitimate user access, compromised processes, or other exploitation chains), but once achieved, no additional privileges or user interaction are required to fully exploit the vulnerability.

Root Cause

The root cause is the complete absence of authentication mechanisms on the HTTP service exposed by the Simple Diagnostics Agent. The developers assumed that binding the service to localhost would provide sufficient security, neglecting to implement any form of credential verification, token validation, or access control for API endpoints.

This represents a fundamental security design flaw where network-level isolation was incorrectly treated as a substitute for application-level authentication controls.

Attack Vector

An attacker with local system access can directly communicate with the Simple Diagnostics Agent service on http://localhost:3005. The attack vector involves:

1. Gaining local access to a system running the vulnerable SAP Simple Diagnostics Agent
2. Identifying the service listening on port 3005
3. Sending unauthenticated HTTP requests to administrative endpoints
4. Reading sensitive configuration data or modifying system settings

Since no authentication is required, the attacker can immediately interact with all exposed functionalities. This could be exploited by a malicious insider, through another vulnerability that provides local code execution, or via compromised user credentials on the target system.

For technical details on the exploitation methodology, refer to the Packet Storm Security Advisory and the Full Disclosure posting.

Detection Methods for CVE-2022-24396

Indicators of Compromise

• Unexpected HTTP traffic to localhost:3005 from non-SAP processes
• Unusual configuration changes to SAP Diagnostics Agent settings
• Access to administrative endpoints without corresponding authentication logs
• Suspicious process activity interacting with the Diagnostics Agent service

Detection Strategies

• Monitor local network connections to port 3005 for unusual process sources
• Implement file integrity monitoring on SAP Diagnostics Agent configuration files
• Deploy endpoint detection solutions to identify unauthorized API access patterns
• Audit local user activity and process creation events on systems running the vulnerable agent

Monitoring Recommendations

• Enable comprehensive logging for the Simple Diagnostics Agent service
• Configure SentinelOne to monitor for suspicious localhost HTTP activity on port 3005
• Establish baseline behavior for legitimate Diagnostics Agent communications
• Implement alerting for configuration file modifications outside of maintenance windows

How to Mitigate CVE-2022-24396

Immediate Actions Required

• Update SAP Simple Diagnostics Agent to a patched version beyond 1.57
• Review systems for indicators of compromise before and after patching
• Restrict local user access to systems running the vulnerable agent
• Implement network segmentation to limit exposure of affected systems

Patch Information

SAP has released security patches to address this vulnerability. Organizations should apply the fix documented in SAP Support Note #3145987. Additional guidance is available in the SAP Security Documentation.

Customers should upgrade to a version of SAP Simple Diagnostics Agent newer than 1.57 that includes proper authentication mechanisms for the localhost HTTP service.

Workarounds

• Implement strict local access controls to limit which users and processes can access the system
• Use host-based firewall rules to restrict access to port 3005 to authorized processes only
• Deploy application whitelisting to prevent unauthorized programs from communicating with the agent
• Consider disabling the Simple Diagnostics Agent if not required for operations until patching can be completed

# Example: Restrict access to port 3005 using iptables (Linux)
# Only allow specific UID to access the diagnostics port
iptables -A OUTPUT -p tcp --dport 3005 -m owner ! --uid-owner sap_user -j DROP