CVE-2022-41264: SAP Basis RCE Vulnerability

CVE-2022-41264 Overview

CVE-2022-41264 is a code injection vulnerability in SAP BASIS caused by unrestricted scope in the RFC (Remote Function Call) function module. This flaw allows an authenticated non-administrator attacker to access system classes and execute any of their public methods with attacker-supplied parameters. Successful exploitation grants the attacker full control over the affected SAP system, resulting in severe integrity compromise.

Critical Impact

Authenticated attackers can achieve full system control by exploiting unrestricted RFC function module scope to execute arbitrary public methods with malicious parameters, severely compromising application integrity.

Affected Products

• SAP BASIS versions 731, 740, 750, 751, 752, 753, 754, 755
• SAP BASIS versions 756, 757
• SAP BASIS versions 789, 790, 791

Discovery Timeline

• December 13, 2022 - CVE-2022-41264 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-41264

Vulnerability Analysis

The vulnerability stems from insufficient access restrictions on the RFC function module within SAP BASIS. The RFC interface is designed to allow external programs and systems to call functions within the SAP system. However, due to improper scope limitations, authenticated users—even those without administrative privileges—can invoke system-level classes and execute their public methods.

This design flaw effectively bypasses SAP's authorization model, allowing any authenticated user to leverage the RFC interface as a gateway to system-level functionality. The attacker can provide arbitrary parameters to these methods, enabling manipulation of critical system operations, data modification, and potentially the execution of privileged operations that should be restricted to administrators.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection), reflecting the ability to inject and execute code through the RFC mechanism.

Root Cause

The root cause is the unrestricted scope configuration of the RFC function module in affected SAP BASIS versions. The module fails to properly validate caller permissions and restrict access to sensitive system classes. This allows any authenticated user to bypass intended authorization controls and access functionality that should only be available to privileged accounts. The lack of granular access control on the RFC layer creates an attack surface where low-privileged users can escalate their capabilities.

Attack Vector

The attack is network-based and requires only basic authenticated access to the SAP system. An attacker with valid credentials (even low-privileged) can:

1. Establish a connection to the SAP system via RFC
2. Identify accessible system classes through the unrestricted RFC interface
3. Enumerate public methods available within these classes
4. Invoke methods with attacker-controlled parameters
5. Achieve arbitrary code execution or system manipulation depending on the targeted class and method

The exploitation does not require user interaction and has low attack complexity, making it particularly dangerous in environments where multiple users have basic SAP access. The RFC protocol's remote accessibility means this can be exploited from any network location with connectivity to the SAP system.

Detection Methods for CVE-2022-41264

Indicators of Compromise

• Unusual RFC connection patterns from non-administrator accounts accessing system-level function modules
• Audit logs showing low-privileged users invoking restricted system classes via RFC
• Unexpected parameter values in RFC calls to sensitive functions
• Anomalous system modifications or configuration changes traced back to non-administrative sessions

Detection Strategies

• Enable comprehensive RFC call logging and monitor for access attempts to sensitive system classes
• Implement SIEM rules to detect authenticated users making RFC calls outside their normal operational scope
• Review SAP Security Audit Log (SM21) for unauthorized function module executions
• Deploy network monitoring to identify RFC traffic patterns indicative of enumeration or exploitation attempts

Monitoring Recommendations

• Establish baseline RFC usage patterns per user role and alert on deviations
• Monitor for bulk RFC calls or rapid enumeration behavior from single sessions
• Configure alerts for RFC access to system classes from non-administrator accounts
• Regularly audit RFC-enabled function modules and their authorization requirements

How to Mitigate CVE-2022-41264

Immediate Actions Required

• Apply the security patch documented in SAP Note #3268172 immediately
• Review and restrict RFC-enabled function modules to only those required for business operations
• Audit user accounts with RFC access and remove unnecessary permissions
• Enable enhanced logging for RFC activities pending patch deployment

Patch Information

SAP has released a security patch addressing this vulnerability. Administrators should apply the fix documented in SAP Note #3268172. The patch restricts the scope of RFC function modules to prevent unauthorized access to system classes. Organizations should follow SAP's standard patch deployment procedures and test in non-production environments before production rollout. Additional security guidance is available in the SAP Security Documentation.

Workarounds

• Implement strict authorization checks on RFC-enabled function modules at the application layer
• Use SAP's authorization concept to restrict which users can access RFC interfaces
• Segment network access to SAP systems to limit exposure of RFC ports
• Consider disabling non-essential RFC function modules until patching is complete

# SAP transaction to review RFC authorizations
# Execute SM59 to review RFC destinations and their security settings
# Execute SU24 to check authorization defaults for RFC-enabled function modules
# Execute STRUST to verify certificate configurations for secure RFC connections