CVE-2022-24396: SAP Simple Diagnostics Agent Auth Bypass

CVE-2022-24396 Overview

CVE-2022-24396 is a missing authentication vulnerability in the SAP Simple Diagnostics Agent. Versions 1.0 through 1.57 expose administrative functionality on localhost over HTTP port 3005 without performing any authentication checks. Any local user or process able to reach the loopback interface can interact with privileged agent endpoints. An attacker leveraging this gap can read, modify, or delete sensitive information and configurations managed by the agent. The weakness is classified as CWE-306: Missing Authentication for Critical Function.

Critical Impact
A local attacker with low privileges can fully compromise the confidentiality, integrity, and availability of the SAP Simple Diagnostics Agent by issuing unauthenticated HTTP requests to port 3005 on the host.

Affected Products

SAP Simple Diagnostics Agent version 1.0
SAP Simple Diagnostics Agent versions through 1.57
SAP Focused Run deployments shipping the affected agent

Discovery Timeline

2022-03-10 - CVE-2022-24396 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24396

Vulnerability Analysis

The SAP Simple Diagnostics Agent exposes an HTTP listener on 127.0.0.1:3005 to support local diagnostic and management workflows. The listener accepts requests without verifying the identity of the caller. Any process on the host, including those running under low-privileged local accounts, can invoke endpoints intended for administrative use.

Because the agent typically operates with elevated privileges to read SAP configuration and runtime data, unauthenticated calls translate directly into privileged operations. An attacker can retrieve sensitive configuration, tamper with agent settings, or remove operational data. The flaw maps to [CWE-306] and reflects a classic failure to separate the trust boundary between localhost callers and authenticated administrators.

The EPSS probability for in-the-wild exploitation is 0.184%, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is the absence of any authentication or authorization layer on the HTTP service bound to port 3005. The developers relied on the loopback binding as an implicit trust boundary. Multi-user hosts, shared SAP application servers, and systems running additional services on the same host violate that assumption.

Attack Vector

Exploitation requires local access to the host running the affected agent. An authenticated user, a compromised service account, or a malicious process can send standard HTTP requests to http://127.0.0.1:3005/ and reach administrative endpoints. No user interaction is required, and the attack complexity is low.

The vulnerability mechanism is described in the Packet Storm advisory and the Full Disclosure post. No verified public proof-of-concept code is referenced by the vendor sources.

Detection Methods for CVE-2022-24396

Indicators of Compromise

Unexpected HTTP requests originating from non-administrative local processes targeting 127.0.0.1:3005.
Changes to SAP Simple Diagnostics Agent configuration files or registry entries outside of approved change windows.
Local user sessions invoking curl, wget, or scripting interpreters against the agent endpoint.
Diagnostic data, logs, or configuration items deleted or modified without a corresponding administrator action.

Detection Strategies

Audit local HTTP traffic to port 3005 and alert on callers that are not the SAP administrator or expected service accounts.
Inspect process command lines for HTTP client invocations referencing localhost:3005 or 127.0.0.1:3005.
Correlate file integrity changes on the agent's configuration directories with the parent process responsible for the write.

Monitoring Recommendations

Enable verbose access logging on the Simple Diagnostics Agent and forward logs to a centralized SIEM or data lake.
Track installed agent versions across the estate and flag any host still running versions 1.0 through 1.57.
Monitor privileged file system paths used by SAP Focused Run for unauthorized modification.

How to Mitigate CVE-2022-24396

Immediate Actions Required

Apply the fix referenced in SAP Security Note #3145987 on all hosts running the Simple Diagnostics Agent.
Upgrade SAP Simple Diagnostics Agent to a version later than 1.57.
Restrict interactive and remote shell access on SAP hosts to a minimum set of administrators.
Review agent configuration and audit logs for tampering since the agent was deployed.

Patch Information

SAP addressed the issue through SAP Security Note #3145987. Additional vendor guidance is available in the SAP Documentation PDF. Customers should follow the standard SAP patch deployment process for Focused Run components and validate the agent version after upgrade.

Workarounds

Block non-administrative local users from initiating connections to 127.0.0.1:3005 using host-based firewall rules where supported.
Enforce least privilege on SAP application servers so that only required service accounts can execute on the host.
Disable the Simple Diagnostics Agent on hosts where it is not actively required until patching is complete.

bash

# Configuration example: restrict local access to port 3005 with iptables
sudo iptables -A OUTPUT -o lo -p tcp --dport 3005 -m owner ! --uid-owner sapadm -j REJECT
sudo iptables -A INPUT  -i lo -p tcp --dport 3005 -m state --state NEW -m owner ! --uid-owner sapadm -j REJECT