CVE-2024-22129: SAP Companion XSS Vulnerability

CVE-2024-22129 Overview

CVE-2024-22129 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in SAP Companion versions prior to 3.1.38. The flaw resides in a URL parameter that fails to sanitize attacker-controlled input before rendering it in the web application. An attacker can craft a malicious link and deliver it to an authenticated user through phishing or other social engineering. When the victim clicks the link, injected script executes in the context of the SAP Companion web application. SAP addressed the issue in Security Note #3404025.

Critical Impact
Successful exploitation allows attackers to retrieve sensitive information from the user's session and cause limited integrity impact on the web application, with the scope extending beyond the vulnerable component.

Affected Products

SAP Companion versions prior to 3.1.38

Discovery Timeline

2024-02-13 - CVE-2024-22129 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22129

Vulnerability Analysis

SAP Companion delivers contextual in-application help for SAP products. The vulnerable versions accept user-supplied input through a URL parameter and reflect that input back into the rendered page without adequate output encoding. This behavior enables a classic reflected XSS condition mapped to [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Exploitation requires user interaction and low-privilege authentication. The vulnerability has a changed scope, meaning injected script can affect resources beyond the vulnerable component's security boundary. Confidentiality impact is high because session tokens, personal data, and business context accessible to the victim can be exfiltrated. Integrity impact is limited, and availability is not affected.

Root Cause

The root cause is missing or insufficient neutralization of special characters in a URL parameter processed by SAP Companion. The application echoes the parameter value into an HTML response context without HTML entity encoding or context-aware sanitization. Any client that renders the response then executes attacker-supplied JavaScript.

Attack Vector

The attack vector is network-based and requires the target to click a crafted link. A typical attack chain involves an attacker composing a URL containing an encoded JavaScript payload in the vulnerable parameter, then delivering it through email, chat, or an untrusted web page. When an authenticated SAP Companion user follows the link, the payload runs in their browser session and can read cookies, tokens, DOM contents, or issue authenticated requests on the user's behalf. Refer to SAP Note #3404025 for technical guidance from the vendor.

Detection Methods for CVE-2024-22129

Indicators of Compromise

Inbound HTTP requests to SAP Companion endpoints containing URL-encoded <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload= in query parameters.
Web server access logs showing unusually long query strings or repeated parameter values containing HTML entities and JavaScript keywords.
Outbound requests from user browsers to unfamiliar domains immediately after loading a SAP Companion URL, indicating potential token or cookie exfiltration.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query parameters for XSS payload patterns targeting SAP Companion URLs.
Correlate proxy logs with SAP Companion authentication events to identify users who followed suspicious external links prior to session anomalies.
Review browser console error telemetry and Content Security Policy (CSP) violation reports from SAP Companion origins for unexpected inline script activity.

Monitoring Recommendations

Monitor for phishing campaigns that reference SAP Companion URLs or SAP support portals in email security gateways.
Track SAP Companion version inventory across the estate and alert when instances below 3.1.38 are discovered.
Ingest SAP Companion and reverse-proxy access logs into a centralized analytics platform to enable retrospective hunting for XSS payload patterns.

How to Mitigate CVE-2024-22129

Immediate Actions Required

Upgrade all SAP Companion instances to version 3.1.38 or later as documented in SAP Security Note #3404025.
Inventory internal and customer-facing deployments to confirm no legacy versions remain reachable.
Notify SAP Companion users of the phishing risk and instruct them to avoid clicking unsolicited SAP-branded links until patching is verified.

Patch Information

SAP released a fix in SAP Companion version 3.1.38. Consult SAP Note #3404025 for the authoritative remediation guidance and the SAP Security Patch Day documentation for additional context.

Workarounds

Enforce a strict Content Security Policy (CSP) on the SAP Companion origin to block inline scripts and untrusted script sources.
Configure WAF rules to filter or reject requests containing script tags, JavaScript URIs, or common XSS payload patterns in URL parameters.
Restrict access to SAP Companion to authenticated internal networks or VPN clients where feasible, reducing exposure to externally delivered malicious links.

bash

# Configuration example: sample nginx CSP header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;