CVE-2024-27898 Overview
CVE-2024-27898 is a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver [CWE-918]. The flaw stems from insufficient input validation in a web application component. An unauthenticated attacker can submit a crafted request that forces the vulnerable NetWeaver instance to issue arbitrary requests to internal systems. These targets are typically unreachable from the external network because they sit behind perimeter firewalls. Successful exploitation produces a limited confidentiality impact. SAP addressed the issue through SAP Security Note #3425188 published in April 2024.
Critical Impact
Unauthenticated attackers can pivot through SAP NetWeaver to probe internal network resources that are otherwise inaccessible from the internet.
Affected Products
- SAP NetWeaver 7.5
- SAP NetWeaver Application Server (web application components)
- Deployments exposing the vulnerable NetWeaver web endpoint to untrusted networks
Discovery Timeline
- 2024-04-09 - CVE-2024-27898 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-27898
Vulnerability Analysis
The vulnerability lives in an SAP NetWeaver web application that accepts a user-supplied value and uses it to construct an outbound HTTP request. Because the component does not validate or constrain the destination, an attacker can direct the server to connect to arbitrary hosts and ports. This behavior aligns with the SSRF pattern described in CWE-918.
The attack requires no authentication and no user interaction. The attacker interacts only with the external NetWeaver endpoint, but the resulting requests originate from the SAP server inside the trusted network. This allows reconnaissance of internal services, cloud metadata endpoints, and administrative interfaces that assume requests from NetWeaver are trusted.
Impact is scoped to confidentiality. The vulnerability does not grant code execution, data modification, or denial of service by itself. However, SSRF frequently serves as a pivot primitive in multi-stage intrusions targeting SAP landscapes.
Root Cause
The root cause is missing or insufficient validation of a URL or host parameter processed by the NetWeaver web application. The code accepts the input, builds an outbound request, and dispatches it without enforcing an allow list of permitted destinations or protocols.
Attack Vector
An attacker sends an HTTP request to the exposed NetWeaver endpoint over the network. The crafted parameter instructs the server to connect to an internal IP, hostname, or non-HTTP service. Response data or timing differences can disclose information about the internal environment. See SAP Note #3425188 for the official technical description.
Detection Methods for CVE-2024-27898
Indicators of Compromise
- Outbound connections from the SAP NetWeaver host to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254
- Web access logs showing crafted parameters containing URLs, IP addresses, or non-standard URI schemes targeting internal resources
- Unexpected DNS resolutions originating from the NetWeaver application server for internal hostnames
Detection Strategies
- Baseline the normal outbound destinations for the NetWeaver application server and alert on deviations
- Inspect HTTP request parameters delivered to NetWeaver web endpoints for URL-like patterns, encoded IP addresses, and schemes such as file://, gopher://, or dict://
- Correlate inbound external requests with subsequent outbound internal connections within a short time window to surface pivot activity
Monitoring Recommendations
- Forward SAP NetWeaver application and HTTP access logs to a centralized analytics platform for retention and query
- Monitor firewall logs for egress attempts from SAP servers toward management networks, hypervisors, or cloud metadata services
- Track authentication and session anomalies on internal services that trust requests originating from SAP infrastructure
How to Mitigate CVE-2024-27898
Immediate Actions Required
- Apply the SAP-provided fix referenced in SAP Note #3425188 to all affected NetWeaver 7.5 systems
- Inventory NetWeaver instances exposed to the internet or untrusted segments and prioritize them for remediation
- Review web access logs for prior requests matching SSRF indicators and investigate any outbound anomalies
Patch Information
SAP released the patch through SAP Security Note #3425188. The note is distributed through the SAP ONE Support Launchpad and is referenced in the SAP Security Notes Overview. Administrators must authenticate to the SAP support portal to download the correction and follow the implementation instructions tied to the specific NetWeaver support package.
Workarounds
- Restrict outbound network access from the NetWeaver application server to an explicit allow list of required destinations
- Place a reverse proxy or web application firewall in front of NetWeaver and block requests containing URL parameters that target internal address ranges or non-HTTP schemes
- Segment management interfaces and cloud metadata services away from the SAP network path so that SSRF cannot reach high-value targets
# Example egress filtering concept for the SAP NetWeaver host
# Deny outbound traffic to RFC1918 and link-local ranges by default,
# then allow only required internal services explicitly.
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 10.20.30.40 -p tcp --dport 443 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
