CVE-2024-25644: SAP NetWeaver WSRM Information Disclosure

CVE-2024-25644 Overview

CVE-2024-25644 is an information disclosure vulnerability in SAP NetWeaver Web Services Reliable Messaging (WSRM) version 7.50. Under certain conditions, an unauthenticated remote attacker can access information that would otherwise be restricted. The flaw is categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource. Exploitation impacts confidentiality but does not affect integrity or availability. The vulnerability requires no user interaction and can be triggered over the network.

Critical Impact
Remote attackers can access restricted information in SAP NetWeaver WSRM 7.50 without authentication, exposing sensitive application data to unauthorized parties.

Affected Products

SAP NetWeaver 7.50
SAP NetWeaver WSRM (Web Services Reliable Messaging) component
Systems running SAP application server with WSRM enabled

Discovery Timeline

2024-03-12 - CVE-2024-25644 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25644

Vulnerability Analysis

The vulnerability resides in the Web Services Reliable Messaging (WSRM) component of SAP NetWeaver 7.50. WSRM handles reliable message delivery between distributed SAP systems using SOAP over HTTP. The component fails to correctly enforce access restrictions on certain resources, allowing unauthenticated network requests to retrieve protected information.

An attacker leveraging this flaw obtains data intended for authorized users only. The scope remains unchanged, meaning the impact is confined to the vulnerable component. No privileges or user interaction are required to trigger the disclosure.

Root Cause

The root cause is an incorrect permission assignment on a critical resource, as classified by [CWE-732]. WSRM endpoints in the affected version do not enforce proper authorization checks on responses containing restricted data. This design flaw permits network-reachable callers to retrieve information that should require authenticated access.

Attack Vector

Attack traffic originates over the network and targets exposed WSRM endpoints on the SAP NetWeaver Application Server. The attacker crafts SOAP requests to the WSRM service and receives responses containing information that should be access-controlled. Because no authentication is required, any actor able to reach the service port can execute the attack. SAP has not published exploitation details, and no public proof-of-concept exists at the time of this writing. Refer to SAP Note #3425682 for vendor technical detail.

Detection Methods for CVE-2024-25644

Indicators of Compromise

Unexpected inbound SOAP requests to WSRM endpoints from untrusted or external IP addresses
Anomalous response sizes from /wsrm or related NetWeaver web service paths
Access log entries showing unauthenticated requests receiving successful (HTTP 200) responses for restricted operations

Detection Strategies

Review Internet Communication Manager (ICM) logs and NetWeaver HTTP access logs for requests to WSRM service endpoints without valid session tokens
Correlate WSRM request patterns with source IP reputation and expected inter-system communication baselines
Enable SAP Security Audit Log (SAL) to record unauthenticated access attempts against reliable messaging services

Monitoring Recommendations

Forward SAP application server logs to a centralized SIEM for continuous review of WSRM endpoint activity
Alert on unauthenticated SOAP calls to WSRM paths originating outside defined system-integration IP ranges
Track cumulative response payload volumes per source to identify bulk information harvesting attempts

How to Mitigate CVE-2024-25644

Immediate Actions Required

Apply the fix documented in SAP Note #3425682 to affected NetWeaver 7.50 systems
Inventory all SAP NetWeaver 7.50 instances and identify those exposing WSRM services to untrusted networks
Restrict network access to WSRM endpoints so only authorized SAP integration partners can reach them

Patch Information

SAP addressed CVE-2024-25644 through a security note published in the March 2024 patch cycle. Administrators must download and apply SAP Note #3425682 via the SAP Support Portal. Consult the SAP Security Notes Overview for the complete advisory listing and applicability guidance.

Workarounds

Disable the WSRM component on NetWeaver instances where reliable messaging is not required
Place SAP application servers behind a web application firewall or reverse proxy that enforces authentication for WSRM paths
Use network-level segmentation and firewall rules to limit WSRM port exposure to trusted integration systems only

bash

# Example firewall restriction limiting WSRM access to trusted subnets
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP