CVE-2024-47586: SAP NetWeaver ABAP DoS Vulnerability

CVE-2024-47586 Overview

CVE-2024-47586 is a null pointer dereference vulnerability [CWE-476] in SAP NetWeaver Application Server for ABAP and ABAP Platform. An unauthenticated attacker can send a maliciously crafted HTTP request that triggers a null pointer dereference in the kernel. The dereference crashes the system and forces a reboot, making the application server temporarily unavailable. The flaw does not affect confidentiality or integrity, only availability.

Critical Impact
Remote unauthenticated attackers can crash SAP NetWeaver ABAP kernel instances over the network with a single crafted HTTP request, producing repeated denial-of-service conditions across business-critical SAP workloads.

Affected Products

SAP NetWeaver Application Server for ABAP
SAP ABAP Platform
Refer to SAP Note #3504390 for the definitive list of affected kernel versions

Discovery Timeline

2024-11-12 - CVE-2024-47586 published to NVD alongside the SAP November 2024 Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47586

Vulnerability Analysis

The vulnerability resides in the HTTP request handling path of the SAP NetWeaver ABAP kernel. A specific field or header in a crafted HTTP request causes the kernel to dereference a pointer that has not been initialized or has been set to null. The resulting fault terminates the kernel process, which triggers an automatic restart of the ABAP work processes and the application server instance.

Because the request path does not require authentication, any attacker who can reach the HTTP or HTTPS listener of the ABAP server can invoke the crash condition. Repeated requests can hold the server in a continuous crash-restart loop, denying service to legitimate ERP, CRM, or SCM users that depend on the instance.

The issue is scoped to availability. Business data is not exposed and integrity of stored records is not affected, but downtime on production SAP systems has direct operational consequences for financial close, order processing, and manufacturing workflows.

Root Cause

The root cause is a missing null check before pointer dereference in the kernel's HTTP request parser. Under normal traffic, the pointer is populated by an earlier initialization step. A malformed request skips that initialization path, and the kernel proceeds to access memory through the null pointer, triggering a segmentation fault [CWE-476].

Attack Vector

Exploitation requires only network reachability to the ABAP HTTP endpoint, typically the Internet Communication Manager (ICM) on ports such as 8000, 8001, 44300, or 50000. No credentials, user interaction, or prior foothold are required. The attacker sends a single crafted HTTP request; the malformed structure causes the kernel to fault during parsing.

The vulnerability manifests inside the SAP kernel's HTTP dispatch logic. No verified public exploit code is available. Detailed technical specifics are restricted to SAP Note #3504390 for licensed SAP customers.

Detection Methods for CVE-2024-47586

Indicators of Compromise

Unexpected SAP kernel core dumps in /usr/sap/<SID>/<instance>/work/ with signal SIGSEGV in dev_w* trace files
Repeated ICM restart messages in dev_icm and dev_disp logs correlated with inbound HTTP requests from a single source
Sudden spikes in HTTP 5xx responses or dropped TCP connections on ICM listener ports
Abnormal short-lived HTTP requests with malformed headers or unusual URI patterns preceding an instance crash

Detection Strategies

Enable SAP Web Dispatcher and ICM verbose logging to capture full request headers for forensic reconstruction of crash-triggering traffic
Correlate SAP kernel restart events with network-layer telemetry to identify the source IP of the malformed request
Deploy network intrusion detection signatures that flag anomalously structured HTTP requests targeting SAP ICM ports

Monitoring Recommendations

Alert on repeated M ***LOG Q02=> DpHdlDeadWp or work process death entries in dev_disp within short time windows
Track ICM restart counts through SAP Solution Manager or CCMS thresholds and page on-call staff when restarts exceed baseline
Forward SAP kernel traces and ICM logs to a centralized SIEM for correlation with perimeter web application firewall events

How to Mitigate CVE-2024-47586

Immediate Actions Required

Apply the SAP kernel patch referenced in SAP Note #3504390 during the next available maintenance window
Restrict inbound access to ABAP ICM ports to trusted networks using firewall rules or an SAP Web Dispatcher in a DMZ
Review ICM logs for prior crash events that may indicate opportunistic scanning or exploitation attempts

Patch Information

SAP addressed this vulnerability in the November 2024 Security Patch Day release. Customers must download the corrected kernel patch from the SAP Support Portal and follow the version matrix in SAP Note #3504390. Additional guidance on the release cadence is published on the SAP Security Patch Day page.

Workarounds

Place a hardened SAP Web Dispatcher or reverse proxy in front of ABAP application servers to filter malformed HTTP requests
Limit ICM exposure to internal networks and VPN clients until the kernel patch is deployed
Enable rate limiting on perimeter devices to slow repeated crash-inducing requests from a single source

bash

# Example: restrict ICM ports to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 44300 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 44300 -j DROP