CVE-2024-22126: SAP NetWeaver Java XSS Vulnerability

CVE-2024-22126 Overview

CVE-2024-22126 is a reflected Cross-Site Scripting (XSS) vulnerability in the User Admin application of SAP NetWeaver Application Server (AS) for Java version 7.50. The application insufficiently validates and improperly encodes incoming URL parameters before including them in a redirect URL. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary script in the victim's browser session. The flaw is tracked under [CWE-79] and carries a scope-changed CVSS impact due to the ability to affect resources beyond the vulnerable component.

Critical Impact
An attacker can hijack authenticated administrative sessions and exfiltrate sensitive data from SAP NetWeaver AS Java by tricking a user into clicking a crafted URL.

Affected Products

SAP NetWeaver Application Server for Java, version 7.50
Deployments exposing the User Admin application to untrusted networks
Systems relying on browser-based administration for SAP NetWeaver AS Java

Discovery Timeline

2024-02-13 - CVE-2024-22126 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22126

Vulnerability Analysis

The User Admin application accepts URL parameters that influence a redirect response. The application fails to validate the parameter values and does not properly encode them before embedding them into the outgoing redirect URL. As a result, attacker-controlled input reaches the response context without adequate sanitization, enabling reflected XSS. Because the vulnerability changes scope, executed script can access resources authorized to the victim, including administrative session cookies and User Admin functionality. Confidentiality impact is high because stolen tokens can expose user directory data, while integrity and availability impacts are lower and dependent on the victim's privilege level.

Root Cause

The root cause is insufficient input validation and missing context-aware output encoding on URL parameters used in redirect construction. The User Admin component treats parameter values as safe strings and inserts them into HTML or header contexts without HTML entity encoding or URL encoding, violating the encoding requirements described in [CWE-79].

Attack Vector

Exploitation requires user interaction over the network. An attacker crafts a URL targeting the vulnerable User Admin endpoint with a malicious payload embedded in a susceptible parameter. The attacker delivers the URL through phishing, chat, or a compromised web page. When an authenticated SAP administrator or user opens the link, the browser executes the injected script within the origin of the SAP NetWeaver AS Java host. No credentials are required from the attacker to build the payload.

No verified public proof-of-concept code is available for this vulnerability. Refer to the vendor advisories in the SAP Notes referenced below for exploitation preconditions and patch scope.

Detection Methods for CVE-2024-22126

Indicators of Compromise

HTTP requests to User Admin endpoints containing script tags, javascript: URIs, or encoded angle brackets in query parameters.
Unexpected Location response headers from the User Admin application containing attacker-controlled fragments or script payloads.
Session anomalies such as administrative actions originating from unusual client IP addresses shortly after a user clicked an external link.

Detection Strategies

Inspect web server and reverse proxy logs for User Admin URLs containing payload patterns such as %3Cscript, onerror=, or javascript%3A.
Deploy web application firewall (WAF) rules that flag XSS patterns in parameters submitted to SAP NetWeaver AS Java User Admin paths.
Correlate HTTP referrer values with external domains to identify inbound clicks that reached authenticated SAP sessions.

Monitoring Recommendations

Enable verbose access logging on SAP NetWeaver AS Java and forward logs to a centralized analytics platform for pattern-based hunting.
Alert on outbound requests from administrator browsers to unknown domains immediately after User Admin activity, indicating possible token exfiltration.
Monitor SAP audit logs for privileged operations that occur without a corresponding legitimate authentication event.

How to Mitigate CVE-2024-22126

Immediate Actions Required

Apply the fixes documented in SAP Note #3417627 and SAP Note #3557138 to affected NetWeaver AS Java 7.50 systems.
Restrict network access to the User Admin application so that only trusted administrative networks can reach it.
Instruct administrators to avoid clicking untrusted links while authenticated to SAP NetWeaver AS Java.

Patch Information

SAP has released corrective content through its regular Security Patch Day process. Customers should review SAP Note #3417627 and SAP Note #3557138 for the applicable support package and kernel patch levels. Additional context is available in the SAP Document Overview.

Workarounds

Deploy WAF signatures that block XSS payloads in query strings targeting User Admin URLs until patching is complete.
Configure a strict Content Security Policy (CSP) on the reverse proxy fronting SAP NetWeaver AS Java to limit inline script execution.
Enforce short session lifetimes and require re-authentication for privileged User Admin actions to reduce the value of stolen tokens.

bash

# Example WAF rule concept (ModSecurity) to block reflected XSS on User Admin
SecRule REQUEST_URI "@contains /useradmin" \
  "chain,phase:2,deny,status:403,id:1002201,msg:'Potential XSS on SAP User Admin (CVE-2024-22126)'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"