CVE-2024-22131: SAP ABAP Platform Privilege Escalation

CVE-2024-22131 Overview

CVE-2024-22131 affects SAP ABA (Application Basis) across versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, and 75I. An authenticated attacker holding remote execution authorization can abuse a vulnerable interface to invoke application functions outside their permitted scope. The flaw maps to CWE-94: Improper Control of Generation of Code, enabling code injection through the exposed interface. Successful exploitation compromises confidentiality, integrity, and availability of the SAP system. Depending on the invoked function, attackers can read or modify user and business data or render the system unavailable.

Critical Impact
Authenticated attackers can invoke unauthorized application functions to read or modify business data and cause full system outage.

Affected Products

SAP ABAP Platform (Application Basis) versions 700, 701, 702, 731
SAP ABAP Platform versions 740, 750, 751, 752
SAP ABAP Platform versions 75C and 75I

Discovery Timeline

2024-02-13 - CVE-2024-22131 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22131

Vulnerability Analysis

The vulnerability resides in an ABA (Application Basis) interface exposed to users with remote execution privileges. The interface fails to properly restrict which application functions callers may invoke. As a result, a caller can pass a function reference that the interface then executes on their behalf. This turns a bounded remote-execution capability into arbitrary function invocation across the ABAP runtime.

Because the ABAP Platform underpins most SAP business suites, the interface is reachable in a wide range of deployments. Any function the underlying runtime can dispatch becomes potentially callable, including functions handling business data, master data, and administrative operations. The impact scales with the sensitivity of the function ultimately invoked.

Root Cause

The root cause is [CWE-94] Improper Control of Generation of Code. The vulnerable interface accepts caller-supplied input that influences which application function is dispatched, without enforcing that the caller is authorized for the target function. Authorization is evaluated at the interface boundary rather than at each downstream function, so the interface acts as a confused deputy for its callers.

Attack Vector

The attack requires network access to the SAP system and valid credentials for an account that already holds remote execution authorization. The attacker calls the vulnerable interface and specifies a target function they are not otherwise entitled to execute. The interface invokes that function under its own authorization context. Depending on the chosen function, the attacker can exfiltrate or tamper with business data or disrupt platform availability.

No verified public proof-of-concept code is available for this vulnerability. See the SAP Security Note #3420923 for technical details available to licensed customers.

Detection Methods for CVE-2024-22131

Indicators of Compromise

Unexpected remote function call (RFC) invocations from user accounts that historically only interacted with a narrow set of function modules.
ABAP system log (SM21) or security audit log (SM19/RSAU_CONFIG) entries showing authorization checks failing immediately before successful sensitive function execution.
Anomalous access patterns to business data tables shortly after RFC calls from accounts with remote execution authorization.

Detection Strategies

Enable the SAP Security Audit Log and record successful and failed RFC calls, focusing on users with the S_RFC authorization object.
Baseline which function modules each service and batch account normally calls, and alert on deviations.
Correlate RFC invocation events with subsequent reads or updates of sensitive business tables to surface abuse chains.

Monitoring Recommendations

Forward SAP Security Audit Log and gateway logs to a central SIEM for retention and cross-source correlation.
Monitor changes to S_RFC and related authorization objects and review users who hold remote execution rights on a recurring basis.
Track patch state of the ABAP Platform kernel and ABA component across all systems to identify unpatched hosts.

How to Mitigate CVE-2024-22131

Immediate Actions Required

Apply the fix documented in SAP Security Note #3420923 to every affected ABAP Platform release in scope.
Inventory accounts granted remote execution authorization and revoke S_RFC privileges that are not required for business function.
Restrict RFC gateway access using secinfo and reginfo allow-lists so that only known hosts can reach the platform.

Patch Information

SAP addressed CVE-2024-22131 in SAP Security Note #3420923, published as part of SAP's monthly security patch day. Refer to the SAP Security Patch Day - February 2022 documentation and the SAP Note #3420923 for version-specific correction instructions across ABAP Platform 700 through 75I.

Workarounds

If immediate patching is not possible, remove remote execution authorizations from all non-essential users and service accounts.
Constrain the RFC gateway with strict secinfo/reginfo rules and disallow registration of external servers.
Enable and review the SAP Security Audit Log with a filter on RFC and authorization failure events tied to the affected component.

bash

# Example RFC gateway hardening in reginfo/secinfo
# reginfo (registration control)
P TP=* HOST=local,internal ACCESS=* CANCEL=*
P TP=* HOST=* ACCESS=DENY

# secinfo (start control)
P USER=* USER-HOST=internal HOST=local TP=*
P USER=* USER-HOST=* HOST=* TP=* CANCEL=DENY