CVE-2024-27902: SAP NetWeaver AS ABAP XSS Vulnerability

CVE-2024-27902 Overview

CVE-2024-27902 is a reflected Cross-Site Scripting (XSS) vulnerability affecting applications built on SAP GUI for HTML in SAP NetWeaver AS ABAP. The flaw exists in versions 7.89 and 7.93, where user-controlled input is not sufficiently encoded before being rendered in the browser. An attacker who convinces an authenticated user to click a crafted link can execute arbitrary script in that user's session context. Successful exploitation allows the attacker to read and modify data accessible to the victim through the browser. Availability of the SAP system is not impacted. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser session, enabling theft or modification of SAP business data accessible to the compromised user.

Affected Products

SAP NetWeaver AS ABAP with SAP UI 7.89
SAP NetWeaver AS ABAP with SAP UI 7.93
Applications rendered through SAP GUI for HTML on the affected releases

Discovery Timeline

2024-03-12 - CVE-2024-27902 published to NVD
2024-03-12 - SAP releases SAP Note 3377979 with the security fix
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27902

Vulnerability Analysis

The vulnerability resides in the request-handling and rendering logic that SAP GUI for HTML uses to reflect user-supplied parameters back into generated HTML pages. Because the affected components do not fully encode input before writing it into the response, an attacker can embed script fragments that the browser will parse and execute. Exploitation requires user interaction, typically clicking a crafted URL, and the attack crosses a trust boundary because script executes in the authenticated SAP session context. Confidentiality and integrity of data reachable by that user are affected, while the SAP backend itself remains available.

Root Cause

The root cause is missing or insufficient output encoding of user-controlled inputs in the HTML rendering layer of SAP GUI for HTML. Parameters that should be treated as data are rendered into HTML, attribute, or JavaScript contexts without context-appropriate escaping. This is a classic [CWE-79] failure: input flows to a sink (HTML response) without neutralization.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL targeting an affected SAP GUI for HTML application containing a malicious payload in a vulnerable parameter. When an authenticated SAP user opens the link, the reflected payload executes in the browser. Because the vulnerability affects a scoped component and the payload runs in the user's SAP session, the attacker can invoke transactions, exfiltrate data returned to the browser, or perform actions on behalf of the victim.

No public proof-of-concept or exploit code has been published for this issue. Technical specifics are restricted to the vendor advisory in SAP Note 3377979.

Detection Methods for CVE-2024-27902

Indicators of Compromise

HTTP requests to SAP GUI for HTML endpoints containing script tags, event handlers such as onerror=, onload=, or javascript: URIs in query parameters.
Web server or reverse proxy logs showing unusually long or URL-encoded parameter values referencing SAP transactions.
Referrer headers indicating users arrived at SAP URLs from untrusted external sources such as email or chat platforms.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns targeting SAP /sap/bc/gui/sap/its/ and related paths.
Enable Content Security Policy (CSP) reporting to capture script execution violations originating from SAP GUI for HTML pages.
Correlate SAP web dispatcher access logs with browser-side error telemetry to identify anomalous script inclusion attempts.

Monitoring Recommendations

Monitor SAP Security Audit Log (SM19/SM20) for unexpected transaction executions initiated shortly after user clicks on external links.
Track outbound requests from user workstations to unknown domains that follow SAP GUI for HTML session activity, which may indicate data exfiltration via injected script.
Alert on repeated 4xx/5xx responses from SAP web endpoints containing script-like payloads in query strings.

How to Mitigate CVE-2024-27902

Immediate Actions Required

Apply the fix documented in SAP Note 3377979 to all SAP NetWeaver AS ABAP systems running SAP UI 7.89 or 7.93.
Inventory internet-facing SAP GUI for HTML deployments and prioritize patching those exposed to untrusted networks.
Educate SAP users about phishing links that target authenticated SAP sessions.

Patch Information

SAP addressed CVE-2024-27902 through SAP Note 3377979, published as part of the SAP Security Patch Day. Administrators should consult the SAP Security Notes News portal for the applicable support package or correction instructions for their release.

Workarounds

Restrict access to SAP GUI for HTML through network segmentation and VPN so that only authenticated users on managed devices can reach the application.
Enforce a strict Content Security Policy on the SAP Web Dispatcher or upstream reverse proxy to block inline script execution.
Configure browsers used to access SAP with modern XSS protections and disable script execution on untrusted origins where feasible.

bash

# Example CSP header enforced at the SAP Web Dispatcher / reverse proxy
# to reduce impact of reflected XSS in SAP GUI for HTML
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;