CVE-2024-47578: Adobe Document Service SSRF Vulnerability

CVE-2024-47578 Overview

CVE-2024-47578 is a Server-Side Request Forgery (SSRF) vulnerability in SAP Adobe Document Service. An attacker with administrator privileges can send a crafted request from a vulnerable web application to reach internal systems behind firewalls. These targets are normally inaccessible from the external network. Successful exploitation allows the attacker to read or modify arbitrary files and render the entire system unavailable. The flaw maps to CWE-918: Server-Side Request Forgery. SAP addressed the issue on its December 2024 Security Patch Day.

Critical Impact

A network-accessible attacker with administrator privileges can pivot through SAP Adobe Document Service to read or modify any file on reachable internal systems and disrupt service availability.

Affected Products

• SAP Adobe Document Service (see SAP Note #3536965 for affected versions)
• SAP NetWeaver components leveraging Adobe Document Service
• Internal systems reachable from the SAP application server

Discovery Timeline

• 2024-12-10 - CVE-2024-47578 published to the National Vulnerability Database
• 2024-12-10 - SAP releases security patch via SAP Note #3536965 on Security Patch Day
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-47578

Vulnerability Analysis

The vulnerability resides in SAP Adobe Document Service, a component used to render and process Adobe forms within SAP environments. The service accepts request parameters that influence outbound HTTP or network connections without validating the destination. An authenticated administrator can craft a request that forces the service to issue requests to arbitrary internal endpoints. This pattern matches the classic Server-Side Request Forgery (SSRF) class tracked under CWE-918. Because the SAP application server typically sits inside a trusted network segment, attacker-controlled requests can reach databases, metadata services, management interfaces, and other internal hosts. The advisory states the impact extends beyond information disclosure to file read, file modification, and full denial of service.

Root Cause

The root cause is missing or insufficient validation of user-supplied URLs or network targets passed to the Adobe Document Service request handler. The service trusts administrator input and forwards crafted requests without enforcing an allow-list of destinations, protocols, or hosts.

Attack Vector

The attack vector is the network. An authenticated attacker holding administrator privileges submits a crafted HTTP request to the vulnerable Adobe Document Service endpoint. The service then issues attacker-directed requests, which can target loopback interfaces, internal subnets, or cloud metadata services. The scope is changed because the request originates from the SAP server's security context, allowing access to resources the attacker could not reach directly. No verified public proof-of-concept code is available for this vulnerability. Refer to SAP Note #3536965 for technical specifics restricted to authenticated customers.

Detection Methods for CVE-2024-47578

Indicators of Compromise

• Outbound HTTP requests from the SAP application server to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
• Unexpected entries in Adobe Document Service request logs referencing non-document URLs or unusual schemes such as file://, gopher://, or ftp://.
• Administrator-initiated requests to Adobe Document Service endpoints that deviate from normal form-rendering traffic patterns.

Detection Strategies

• Inspect SAP application server proxy and firewall logs for outbound connections originating from the Adobe Document Service process to non-standard destinations.
• Correlate administrator authentication events with subsequent Adobe Document Service requests carrying URL parameters that target internal hosts.
• Monitor file integrity on hosts reachable from the SAP server, since the advisory confirms read and write impact on internal files.

Monitoring Recommendations

• Enable verbose logging on the Adobe Document Service and forward logs to a centralized SIEM with retention sufficient for retrospective hunting.
• Baseline normal egress traffic from SAP servers and alert on deviations, particularly to RFC1918 ranges and cloud metadata IPs.
• Review privileged account activity for SAP administrators on a regular cadence to identify abuse of elevated permissions.

How to Mitigate CVE-2024-47578

Immediate Actions Required

• Apply the SAP-provided fix referenced in SAP Note #3536965 to all affected systems.
• Audit and reduce the number of accounts holding administrator privileges on SAP Adobe Document Service.
• Restrict outbound network connectivity from SAP application servers to only required destinations using host firewalls and egress filtering.

Patch Information

SAP released the official fix on the December 2024 Security Patch Day. Customers must authenticate to the SAP support portal to retrieve SAP Note #3536965 and follow the documented upgrade or kernel patch procedure. Additional advisories are listed on the SAP Security Patch Day page.

Workarounds

• Place SAP application servers behind an egress proxy that enforces an allow-list of permitted destinations until patching is complete.
• Segment internal networks so that the SAP server cannot reach sensitive management interfaces, databases, or cloud metadata services directly.
• Enforce multi-factor authentication and strict change control on accounts with SAP administrator privileges to limit the population that could trigger the flaw.

# Example: restrict outbound traffic from the SAP server using iptables
# Allow only required destinations; drop everything else
iptables -A OUTPUT -d 10.0.10.25 -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j DROP