CVE-2024-45282: SAP S/4HANA Privilege Escalation Vulnerability

CVE-2024-45282 Overview

CVE-2024-45282 affects SAP S/4HANA's Manage Bank Statements application. Fields marked as read-only in Bank Statement Draft records can be modified through the OData MERGE method. The vulnerability stems from missing server-side enforcement of immutable field properties on an OData entity, allowing external modification of protected attributes.

The flaw enables authenticated attackers to bypass client-side read-only restrictions and alter financial data intended to remain immutable. Confidentiality and availability are not affected, but integrity of bank statement drafts can be compromised.

Critical Impact
Attackers with network access can modify read-only fields in bank statement drafts, leading to integrity violations in financial records processed by SAP S/4HANA.

Affected Products

SAP S/4HANA versions 102 through 104
SAP S/4HANA versions 105 and 106
SAP S/4HANA version 107

Discovery Timeline

2024-10-08 - CVE-2024-45282 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45282

Vulnerability Analysis

The vulnerability resides in the OData service backing the Manage Bank Statements application in SAP S/4HANA. Fields displayed as read-only in the Bank Statement Draft user interface are not enforced as immutable on the server side. When a client issues an HTTP MERGE request against the OData entity, the service processes updates to properties that should be protected.

This is a trust boundary violation classified as [CWE-650] (Trusting HTTP Permission Methods on the Server Side). The application relies on client-side controls to signal which fields are read-only rather than enforcing constraints in the OData handler. Attackers who understand the entity model can craft MERGE payloads that alter protected properties without triggering validation.

The result is an integrity impact on financial draft records. While the vulnerability does not permit direct disclosure of confidential data or service disruption, tampered bank statement drafts can propagate into downstream reconciliation and posting workflows.

Root Cause

The SAP OData service does not validate whether a property is marked immutable before applying updates from a MERGE request. The read-only designation exists in metadata consumed by the UI, but the backend accepts modifications to those same fields when submitted through the MERGE HTTP verb.

Attack Vector

Exploitation requires network access to the SAP S/4HANA OData endpoint and valid authentication to the Manage Bank Statements application. The attacker sends an HTTP MERGE request targeting a Bank Statement Draft entity and includes values for fields that the UI presents as read-only. The server processes the update without rejecting the protected properties. No user interaction is required, and the attack complexity is low. Refer to SAP Note #3251893 for the vendor's technical description.

Detection Methods for CVE-2024-45282

Indicators of Compromise

HTTP MERGE requests against Bank Statement Draft OData entities containing values for fields designated as read-only in the entity metadata.
Unexpected modifications to Bank Statement Draft records without a corresponding user session in the Manage Bank Statements application.
Audit log entries showing field-level changes to draft bank statements from atypical client IP addresses or service accounts.

Detection Strategies

Enable SAP OData request logging and inspect MERGE operations targeting the Manage Bank Statements service for updates to non-editable properties.
Correlate SAP Gateway logs with application-level change documents to identify modifications that bypass expected UI workflows.
Baseline normal OData traffic patterns for the Manage Bank Statements service and alert on anomalous MERGE volume or field coverage.

Monitoring Recommendations

Forward SAP Security Audit Log and Gateway logs to a centralized SIEM for continuous review of financial application activity.
Monitor privileged and service accounts that access the Manage Bank Statements OData service for unusual write patterns.
Track change documents on Bank Statement Draft tables to detect unauthorized alterations of previously validated fields.

How to Mitigate CVE-2024-45282

Immediate Actions Required

Apply the fix documented in SAP Note #3251893 to affected SAP S/4HANA systems (versions 102 through 107).
Review recent MERGE activity against the Manage Bank Statements OData service for signs of exploitation.
Restrict access to the Manage Bank Statements application to users with a documented business need until patching is complete.

Patch Information

SAP addressed CVE-2024-45282 through the security note published on SAP Security Patch Day. Customers should download and install the correction delivered in SAP Note #3251893 and follow the guidance on the SAP Security Patch Day portal. Apply the patch across all affected S/4HANA releases (102, 103, 104, 105, 106, and 107).

Workarounds

Restrict authorization for the Manage Bank Statements application (transaction and OData service) to a minimal set of trusted users pending patch deployment.
Enable enhanced SAP Security Audit Log coverage for the Bank Statement Draft entity and review logs for suspicious MERGE requests.
Implement compensating controls at the reverse proxy or SAP Web Dispatcher layer to log and inspect MERGE HTTP verbs directed at the affected service.

bash

# Configuration example: verify installed SAP Note via transaction SNOTE
# or query note status through the SAP GUI. Consult SAP Note #3251893
# for the exact support package and patch level required for your release.