CVE-2022-41264: SAP Basis RCE Vulnerability

CVE-2022-41264 Overview

CVE-2022-41264 is a code injection vulnerability in SAP BASIS caused by unrestricted scope in the RFC (Remote Function Call) function module. This flaw allows an authenticated non-administrator attacker to access system classes and execute any of their public methods with attacker-supplied parameters. Successful exploitation grants the attacker full control over the affected SAP system, resulting in severe integrity compromise.

Critical Impact
Authenticated attackers can achieve full system control by exploiting unrestricted RFC function module scope to execute arbitrary public methods with malicious parameters, severely compromising application integrity.

Affected Products

SAP BASIS versions 731, 740, 750, 751, 752, 753, 754, 755
SAP BASIS versions 756, 757
SAP BASIS versions 789, 790, 791

Discovery Timeline

December 13, 2022 - CVE-2022-41264 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-41264

Vulnerability Analysis

The vulnerability stems from insufficient access restrictions on the RFC function module within SAP BASIS. The RFC interface is designed to allow external programs and systems to call functions within the SAP system. However, due to improper scope limitations, authenticated users—even those without administrative privileges—can invoke system-level classes and execute their public methods.

This design flaw effectively bypasses SAP's authorization model, allowing any authenticated user to leverage the RFC interface as a gateway to system-level functionality. The attacker can provide arbitrary parameters to these methods, enabling manipulation of critical system operations, data modification, and potentially the execution of privileged operations that should be restricted to administrators.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection), reflecting the ability to inject and execute code through the RFC mechanism.

Root Cause

The root cause is the unrestricted scope configuration of the RFC function module in affected SAP BASIS versions. The module fails to properly validate caller permissions and restrict access to sensitive system classes. This allows any authenticated user to bypass intended authorization controls and access functionality that should only be available to privileged accounts. The lack of granular access control on the RFC layer creates an attack surface where low-privileged users can escalate their capabilities.

Attack Vector

The attack is network-based and requires only basic authenticated access to the SAP system. An attacker with valid credentials (even low-privileged) can:

Establish a connection to the SAP system via RFC
Identify accessible system classes through the unrestricted RFC interface
Enumerate public methods available within these classes
Invoke methods with attacker-controlled parameters
Achieve arbitrary code execution or system manipulation depending on the targeted class and method

The exploitation does not require user interaction and has low attack complexity, making it particularly dangerous in environments where multiple users have basic SAP access. The RFC protocol's remote accessibility means this can be exploited from any network location with connectivity to the SAP system.

Detection Methods for CVE-2022-41264

Indicators of Compromise

Unusual RFC connection patterns from non-administrator accounts accessing system-level function modules
Audit logs showing low-privileged users invoking restricted system classes via RFC
Unexpected parameter values in RFC calls to sensitive functions
Anomalous system modifications or configuration changes traced back to non-administrative sessions

Detection Strategies

Enable comprehensive RFC call logging and monitor for access attempts to sensitive system classes
Implement SIEM rules to detect authenticated users making RFC calls outside their normal operational scope
Review SAP Security Audit Log (SM21) for unauthorized function module executions
Deploy network monitoring to identify RFC traffic patterns indicative of enumeration or exploitation attempts

Monitoring Recommendations

Establish baseline RFC usage patterns per user role and alert on deviations
Monitor for bulk RFC calls or rapid enumeration behavior from single sessions
Configure alerts for RFC access to system classes from non-administrator accounts
Regularly audit RFC-enabled function modules and their authorization requirements

How to Mitigate CVE-2022-41264

Immediate Actions Required

Apply the security patch documented in SAP Note #3268172 immediately
Review and restrict RFC-enabled function modules to only those required for business operations
Audit user accounts with RFC access and remove unnecessary permissions
Enable enhanced logging for RFC activities pending patch deployment

Patch Information

SAP has released a security patch addressing this vulnerability. Administrators should apply the fix documented in SAP Note #3268172. The patch restricts the scope of RFC function modules to prevent unauthorized access to system classes. Organizations should follow SAP's standard patch deployment procedures and test in non-production environments before production rollout. Additional security guidance is available in the SAP Security Documentation.

Workarounds

Implement strict authorization checks on RFC-enabled function modules at the application layer
Use SAP's authorization concept to restrict which users can access RFC interfaces
Segment network access to SAP systems to limit exposure of RFC ports
Consider disabling non-essential RFC function modules until patching is complete

bash

# SAP transaction to review RFC authorizations
# Execute SM59 to review RFC destinations and their security settings
# Execute SU24 to check authorization defaults for RFC-enabled function modules
# Execute STRUST to verify certificate configurations for secure RFC connections