CVE-2024-47590: Unauthenticated RCE Vulnerability

CVE-2024-47590 Overview

CVE-2024-47590 is a high-severity vulnerability disclosed through the SAP Security Patch Day program. An unauthenticated attacker can craft a malicious link and distribute it publicly. When an authenticated victim clicks the link, the affected web page reflects the attacker-controlled input into the rendered output. The flaw enables Cross-Site Scripting (XSS) execution in the victim's browser and Server-Side Request Forgery (SSRF) against the back-end server. Successful exploitation results in arbitrary code execution on the server and full compromise of confidentiality, integrity, and availability. The weakness is classified under [CWE-791] (Incomplete Filtering of Special Elements).

Critical Impact

Successful exploitation chains XSS and SSRF to achieve arbitrary code execution on the affected server, fully compromising confidentiality, integrity, and availability.

Affected Products

• SAP product addressed by SAP Note #3520281 (consult the vendor advisory for specific component and version coverage)
• Component details not enumerated in the public NVD record
• Refer to the SAP Security Patch Day announcement for the authoritative product matrix

Discovery Timeline

• 2024-11-12 - CVE-2024-47590 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-47590

Vulnerability Analysis

The vulnerability stems from incomplete filtering of special elements in user-supplied input. The affected web component accepts request parameters from an unauthenticated source and incorporates that data into dynamically generated page content. Because the filtering routine does not neutralize all dangerous characters or URL schemes, attacker input survives into two distinct execution contexts.

In the browser context, injected script payloads execute under the authenticated victim's session, enabling session theft, request forgery, and arbitrary actions against the application. In the server context, the same input can coerce the back-end to issue outbound HTTP requests to attacker-chosen targets, producing SSRF. When the SSRF reaches an internal management interface or an unsafe handler, it pivots to arbitrary code execution on the host.

User interaction is required because the victim must follow the malicious link, but no prior authentication or privilege is required from the attacker.

Root Cause

The root cause is incomplete input sanitization during page generation. The application accepts request parameters and reflects them into both HTML output and server-side request construction without context-aware encoding or strict URL allowlisting. This single sanitization gap surfaces as XSS in one path and SSRF in another.

Attack Vector

The attack is network-based and requires user interaction. The attacker hosts or publishes a crafted URL pointing to the vulnerable endpoint. A user with an authenticated session clicks the link, the server processes the tainted parameters, and the resulting response and outbound requests carry the attacker payload. The vulnerability is not authenticated and does not require elevated privileges from the attacker.

No public proof-of-concept code is referenced in the NVD entry. Technical specifics are restricted to authenticated SAP customers through SAP Note #3520281 and the SAP Security Patch Day Announcement.

Detection Methods for CVE-2024-47590

Indicators of Compromise

• Inbound HTTP requests containing script tags, JavaScript URI schemes, or HTML event handlers in query string or form parameters reflected by the affected endpoint.
• Outbound HTTP or HTTPS connections from the application server to unexpected internal addresses, cloud metadata endpoints, or attacker-controlled hosts.
• Application logs showing anomalous parameter values containing encoded payloads such as %3Cscript%3E or javascript: schemes.
• New child processes spawned by the web application service after a parameterized request, indicating successful code execution.

Detection Strategies

• Deploy web application firewall rules that inspect query and body parameters for reflected XSS and SSRF patterns targeting the affected component.
• Correlate authentication events with subsequent outbound network calls from the application tier to detect SSRF pivots.
• Hunt for process-creation events on the web server originating from the application runtime user after suspicious inbound requests.

Monitoring Recommendations

• Enable verbose access logging on the affected SAP web component and centralize logs for query and pattern analysis.
• Monitor egress traffic from application servers and alert on connections to RFC1918 ranges, link-local metadata services, and known-malicious infrastructure.
• Track session activity for authenticated users who follow externally referred links to the application and flag anomalous follow-on actions.

How to Mitigate CVE-2024-47590

Immediate Actions Required

• Apply the fix described in SAP Note #3520281 on all affected SAP systems without delay.
• Inventory exposed SAP web endpoints reachable from untrusted networks and prioritize patching internet-facing instances first.
• Invalidate active user sessions after patching to eliminate any session tokens that may have been exfiltrated prior to remediation.

Patch Information

SAP released a security correction documented in SAP Note #3520281, distributed through the SAP Security Patch Day program. Customers must authenticate to the SAP support portal to obtain the patch package and the precise list of affected support package levels. Review the SAP Security Patch Day Announcement for the broader monthly advisory bundle.

Workarounds

• Restrict access to the affected web endpoint using network segmentation or reverse proxy allowlists until the patch is applied.
• Configure the web application firewall to block requests containing script tags, JavaScript URI schemes, and suspicious URL parameters targeting the vulnerable handler.
• Enforce strict egress filtering on the application server so outbound HTTP requests are limited to required destinations, neutralizing SSRF impact.
• Educate users to avoid clicking unsolicited links pointing to internal SAP hostnames or unexpected query strings.

# Example egress restriction using iptables to limit SSRF blast radius
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
iptables -A OUTPUT -m owner --uid-owner sapadm -p tcp -d <allowed-host> -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner sapadm -j REJECT