CVE-2024-33006: Unauthenticated File Upload RCE Vulnerability

CVE-2024-33006 Overview

CVE-2024-33006 is an unrestricted file upload vulnerability (CWE-434) affecting an SAP product. An unauthenticated attacker can upload a malicious file to the server over the network. When a victim subsequently accesses that file, the attacker can fully compromise the system, impacting confidentiality, integrity, and availability.

The issue is tracked by SAP in SAP Note #3448171. Successful exploitation requires user interaction to access the uploaded payload, and the attack crosses a security scope boundary on the affected component.

Critical Impact
Unauthenticated attackers can upload arbitrary files that, when accessed by a victim, lead to complete compromise of the affected SAP system.

Affected Products

SAP product referenced in SAP Note #3448171 (specific product and versions disclosed only to authenticated SAP customers)
Web-facing SAP components that accept file uploads without authentication
Internet-exposed SAP application servers serving uploaded content to end users

Discovery Timeline

2024-05-14 - CVE-2024-33006 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-33006

Vulnerability Analysis

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). The affected SAP component accepts file uploads from network clients without enforcing authentication. The server does not adequately validate the file type, extension, or content before storing the file in a location accessible to other users.

When a victim later requests the uploaded resource, the server or the victim's client processes the malicious content. The resulting execution context permits the attacker to take complete control of the server, including reading data, modifying files, and disrupting service. The attack requires user interaction (UI:R) and changes scope (S:C), reflecting the cross-component impact when the payload is rendered or executed.

Root Cause

The root cause is missing or insufficient server-side validation of uploaded files. The application trusts attacker-supplied filenames, MIME types, or content without enforcing an allow-list of safe types, sanitizing extensions, or storing files outside of executable paths. The absence of authentication on the upload endpoint compounds the risk by exposing the flaw to anonymous internet users.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable SAP upload endpoint, supplying a file that contains executable script, an HTML payload with JavaScript, or other dangerous content. The server stores the file at a predictable or returned URL. The attacker then lures a victim, typically a privileged user, into opening that URL through phishing or a malicious link. Execution of the payload in the victim's session, or by the server when rendering the file, results in full system compromise.

No verified public proof-of-concept code is available. Refer to the SAP Note #3448171 for vendor-supplied technical details.

Detection Methods for CVE-2024-33006

Indicators of Compromise

Unexpected files in SAP upload directories, particularly with executable extensions such as .jsp, .html, .svg, .htm, or double extensions like .pdf.html
HTTP POST or PUT requests to SAP upload endpoints originating from unauthenticated sessions or unknown source IP addresses
Outbound connections from SAP application servers to attacker-controlled infrastructure following file access events
New or modified administrative accounts created shortly after a file access event in SAP audit logs

Detection Strategies

Inspect web server and SAP Internet Communication Manager (ICM) logs for upload requests without a valid authentication cookie or token
Hunt for files written to web-accessible SAP directories whose MIME type does not match the declared extension
Correlate file upload events with subsequent GET requests to the same resource from a different IP address
Apply signatures for common web shell strings and HTML/JavaScript payload patterns to uploaded files at rest

Monitoring Recommendations

Forward SAP application, ICM, and web dispatcher logs to a centralized analytics platform for retention and correlation
Alert on anomalous spikes in file upload volume or unusual MIME types reaching SAP endpoints
Monitor privileged SAP accounts for session activity that follows access to recently uploaded files
Track integrity of SAP file system directories used for content delivery using file integrity monitoring

How to Mitigate CVE-2024-33006

Immediate Actions Required

Apply the fix described in SAP Note #3448171 to all affected SAP systems
Identify and isolate any internet-exposed SAP upload endpoints until the patch is deployed
Review web-accessible directories for unauthorized files and remove or quarantine suspicious uploads
Reset credentials for any accounts that may have accessed malicious uploaded files

Patch Information

SAP released the corrective guidance and binary fix in SAP Note #3448171. Customers should authenticate to the SAP Support Portal to obtain the applicable patch level for their product version. Review the SAP Security Patch Day notes for the May 2024 cycle to confirm prerequisite components and post-installation steps.

Workarounds

Restrict access to the vulnerable upload endpoint at the network layer using a web application firewall or reverse proxy rule
Enforce authentication on all upload endpoints through SAP Web Dispatcher configuration where supported
Configure the web server to serve uploaded content with Content-Disposition: attachment and a non-executable MIME type
Store uploaded files outside of any directory that the web server can render or execute

bash

# Example web dispatcher rule restricting unauthenticated uploads
if %{REQUEST_METHOD} = POST && %{PATH} regimatch ^/sap/.*/upload
  if %{HEADER:Authorization} !regimatch .+
    RegRedirectUrl ^.* /sap/public/denied
  endif
endif