CVE-2024-21735: SAP LT Replication Server Privilege Escalation

CVE-2024-21735 Overview

CVE-2024-21735 is a missing authorization vulnerability [CWE-863] in the SAP Landscape Transformation (LT) Replication Server. The affected component does not perform necessary authorization checks before executing privileged operations. An authenticated attacker with high privileges can leverage this flaw to perform unintended actions on the target system. Successful exploitation results in privilege escalation with high impact on confidentiality, integrity, and availability. The issue affects SAP S/4HANA installations running S4CORE releases 103 through 108.

Critical Impact
An authenticated attacker holding elevated privileges can bypass authorization controls in SAP LT Replication Server, escalating access and compromising the confidentiality, integrity, and availability of core business data.

Affected Products

SAP LT Replication Server on S4CORE 103, S4CORE 104, S4CORE 105
SAP LT Replication Server on S4CORE 106, S4CORE 107, S4CORE 108
SAP S/4HANA environments embedding these S4CORE releases

Discovery Timeline

2024-01-09 - CVE-2024-21735 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21735

Vulnerability Analysis

The SAP LT Replication Server replicates data between source and target systems within an SAP landscape. The vulnerable code path exposes functionality that should be restricted to specific administrative roles. Because the component omits authorization checks, any user with high-level access to the server can invoke operations outside their intended scope. This turns a legitimate administrative surface into a lateral privilege escalation primitive across the replication landscape.

Exploitation does not require user interaction and is delivered over the network. The result is unauthorized read, modification, or disruption of replicated data flows between SAP systems.

Root Cause

The root cause is a missing authorization check classified under [CWE-863] (Incorrect Authorization). SAP application code typically enforces access via AUTHORITY-CHECK statements bound to authorization objects. In the affected LT Replication Server functionality, one or more code paths reach privileged operations without evaluating whether the calling user holds the required authorization object values. The application trusts the caller once basic authentication succeeds.

Attack Vector

An attacker must first authenticate to the SAP system with elevated privileges. From that position, the attacker calls the exposed replication functionality directly, either through a transaction, a Remote Function Call (RFC), or an ABAP report that reaches the vulnerable routine. Because authorization is not verified, the operation executes with the trust boundary of the LT Replication Server. The attacker can then manipulate replication configurations, access source data, or affect target-system integrity. No verified public proof-of-concept exploit is available at the time of writing, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the SAP Note #3407617 and the SAP Security Patch Day advisory for technical details.

Detection Methods for CVE-2024-21735

Indicators of Compromise

Unexpected use of LT Replication Server transactions (for example, LTRC, LTRS) by accounts that do not routinely perform replication administration.
Creation or modification of replication configurations, mass transfers, or table settings outside change windows.
Anomalous RFC calls from user contexts that historically do not interact with the LT Replication Server.

Detection Strategies

Compare active users invoking replication functionality against the approved list of replication administrators.
Enable and review the SAP Security Audit Log (SM19/RSAU_CONFIG) for authorization failures and successful sensitive transactions near the affected components.
Correlate ABAP CHANGEDOCUMENT and table change logs for replication configuration tables to identify unauthorized modifications.

Monitoring Recommendations

Forward SAP Security Audit Log, gateway logs, and RFC call logs to a centralized analytics platform for behavioral baselining.
Alert on privilege usage anomalies for accounts assigned the S4CORE roles that grant LT Replication Server access.
Track SAP Note compliance state via RSECNOTE or SAP Solution Manager to confirm that CVE-2024-21735 remediation notes are applied.

How to Mitigate CVE-2024-21735

Immediate Actions Required

Apply the fixes documented in SAP Note #3407617 to all systems running S4CORE 103 through 108.
Inventory all SAP S/4HANA systems where LT Replication Server components are active and prioritize production and data-hub systems.
Review authorization assignments for users with access to LT Replication Server transactions and remove entitlements not required for job function.

Patch Information

SAP addressed CVE-2024-21735 in the correction delivered through SAP Note #3407617. Customers should apply the corresponding support package or manual correction instructions for their S4CORE release. Refer to the SAP Security Patch Day documentation for release-specific guidance and validation steps.

Workarounds

Restrict authorization objects governing LT Replication Server transactions to a minimal set of administrative accounts until the patch is deployed.
Disable or lock unused LT Replication Server transactions and RFC-callable function modules where operationally feasible.
Enforce segregation of duties so that replication configuration and execution require distinct roles, reducing the blast radius of a compromised privileged account.

bash

# Configuration example: enable SAP Security Audit Log for sensitive events
# Executed in transaction RSAU_CONFIG or via profile parameters
rsau/enable = 1
rsau/selection_slots = 10
rsau/user_selection = 1
# Filter: log successful and failed transaction starts and RFC calls
#   Class: Transaction start (AU3), RFC call (AUK), Authorization check failed (AUW)
#   Users: * (all)  Clients: *