SB2022021025 - HTTP request smuggling in SAP NetWeaver

Description

This security bulletin contains information about 1 vulnerability.

1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2022-22536)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can prepend a victim's request with arbitrary data and execute functions impersonating the victim or poison intermediary Web caches.

Successful exploitation of the vulnerability can result in full system compromise.

Remediation

Install update from vendor's website.

References

• https://launchpad.support.sap.com/#/notes/3123396
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html