CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Description
CVE-2019-0344 is a critical code injection vulnerability in SAP Commerce Cloud (formerly SAP Hybris Commerce), caused by unsafe deserialization in the virtualjdbc extension. An unauthenticated remote attacker can exploit this flaw to execute arbitrary code on the target machine with the privileges of the Hybris service user, achieving complete system compromise. With a CVSS v3.1 base score of 9.8 and the worst-case metrics across all attack parameters, the vulnerability affects SAP Commerce Cloud versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, and 1905. CISA has added CVE-2019-0344 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 21, 2024, and its EPSS score of 40.62% at the 97.3rd percentile demonstrates continued active exploitation years after its initial disclosure in 2019.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | commerce cloud | 6.4; 6.5; 6.6; 6.7; 1808; 1811; 1905 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://launchpad.support.sap.com/#/notes/2786035(Permissions Required, Vendor Advisory)
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0344(US Government Resource)
Weakness Type
Unsafe Deserialization in virtualjdbc Extension
CVE-2019-0344 is an unsafe deserialization vulnerability in the virtualjdbc extension of SAP Commerce Cloud. Deserialization is the process of converting serialized data (typically Java object streams) back into live objects in memory. When an application deserializes untrusted data without validating the types of objects being reconstructed, an attacker can inject specially crafted serialized objects that trigger arbitrary code execution during the deserialization process. In this case, the virtualjdbc extension, which provides a virtual JDBC interface for remote database access in SAP Commerce Cloud, accepts serialized Java objects from the network without proper type validation or sanitization. An attacker can exploit well-known Java deserialization gadget chains to execute arbitrary commands on the server as the Hybris user.
Impact Analysis
Confidentiality is fully compromised by CVE-2019-0344. SAP Commerce Cloud is an enterprise e-commerce platform that processes and stores highly sensitive data including customer personal information, payment card data, order histories, pricing strategies, and business logic. Remote code execution on this platform gives the attacker complete access to the e-commerce database, customer records, and any connected backend systems. The Hybris user context typically has broad access to the Commerce Cloud application and its data stores.
Integrity faces maximum impact as the attacker can modify product catalogs, alter pricing, inject malicious content into the storefront, tamper with order processing logic, and install persistent backdoors. In an e-commerce context, integrity compromise is particularly dangerous because it can enable financial fraud through price manipulation, redirect payments to attacker-controlled accounts, or inject malicious scripts into customer-facing pages for further credential harvesting.
Availability is also fully compromised since the attacker can shut down the e-commerce platform, corrupt databases, or deploy destructive payloads. For businesses dependent on SAP Commerce Cloud for online revenue, any disruption directly translates to financial loss. The EPSS score of 40.62% at the 97.3rd percentile is remarkably high for a vulnerability disclosed in 2019, indicating that despite being over five years old, it remains actively targeted by attackers who scan for unpatched SAP Commerce Cloud instances. While the ransomware association is listed as unknown, the combination of critical business data and high-value e-commerce operations makes this an attractive ransomware target.
Exploit Maturity
CVE-2019-0344 demonstrates sustained long-term exploitation, as evidenced by CISA adding it to the Known Exploited Vulnerabilities catalog in 2024 despite its original disclosure in 2019. This five-year gap underscores that organizations continue to run unpatched SAP Commerce Cloud instances. The EPSS score of 40.62% at the 97.3rd percentile confirms that exploitation activity remains exceptionally high.
SAP has published a security note (SAP Note 2786035) detailing the fix. Java deserialization vulnerabilities are among the most well-understood exploitation techniques, with mature tooling such as ysoserial providing ready-made exploit payloads for various Java application servers. The unauthenticated nature (PR:N) combined with network accessibility (AV:N), low complexity (AC:L), and no user interaction (UI:N) makes this trivially exploitable with publicly available tools. The virtualjdbc extension's exposure of a deserialization endpoint over the network provides a direct attack path that requires no special configuration or environment conditions to exploit. While CISA lists the ransomware association as unknown, SAP Commerce Cloud platforms processing financial transactions and storing customer data are high-value targets for both financially motivated and espionage-oriented threat actors.
Remediation
-
Apply SAP Security Note 2786035 immediately. Access the patch through the SAP Support Launchpad and install the fix for your specific SAP Commerce Cloud version (6.4, 6.5, 6.6, 6.7, 1808, 1811, or 1905). If running an affected version, prioritize this patch as an emergency update given the confirmed active exploitation.
-
Disable or restrict access to the virtualjdbc extension. If the virtualjdbc extension is not required for your deployment, disable it entirely. If it must remain active, restrict network access to the virtualjdbc endpoint using firewall rules, limiting connectivity to only authorized internal systems. The extension should never be exposed to the internet.
-
Upgrade to a current SAP Commerce Cloud version. All affected versions (6.4 through 1905) are significantly outdated. Plan and execute an upgrade to a currently supported SAP Commerce Cloud release that includes comprehensive security fixes and modern security controls including deserialization filters.
-
Conduct forensic investigation of exposed instances. Any SAP Commerce Cloud instance running an affected version that was accessible from untrusted networks should be investigated for signs of compromise. Check for unauthorized files, unexpected processes, modified configurations, suspicious database entries, and evidence of data exfiltration. Pay particular attention to customer payment data and personal information.
-
Implement Java deserialization protections. Deploy Java deserialization filters (JEP 290) at the JVM level to restrict which classes can be deserialized. Configure application-level deserialization whitelists to prevent exploitation of any remaining deserialization endpoints. Monitor for deserialization-related error patterns in application logs that may indicate exploitation attempts.
Technical Details
CVE-2019-0344 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a critical base score of 9.8. Every exploitability metric represents the worst case: the attack is network-accessible (AV:N), requires low complexity (AC:L), needs no privileges (PR:N), and demands no user interaction (UI:N).
The vulnerability exists in the virtualjdbc extension of SAP Commerce Cloud (Hybris). The virtualjdbc extension provides a network-accessible interface that allows remote systems to execute database operations against the Commerce Cloud data tier through a virtual JDBC bridge. This interface accepts serialized Java objects as part of its communication protocol. The critical flaw is that these serialized objects are deserialized without any class type filtering or validation, creating a classic Java unsafe deserialization vulnerability.
Java deserialization attacks exploit the fact that during object reconstruction, the JVM automatically invokes various methods on the deserialized objects (constructors, readObject, readResolve, finalize, etc.). By carefully constructing chains of objects whose method invocations lead to arbitrary code execution (known as "gadget chains"), an attacker can achieve remote code execution by sending a single malicious serialized payload. Well-known gadget chains from libraries commonly present in SAP Commerce Cloud's classpath (such as Apache Commons Collections, Spring Framework, or Groovy) can be used to execute arbitrary operating system commands.
The scope is unchanged (S:U), meaning the vulnerability directly impacts the Commerce Cloud application server. Code execution occurs with the privileges of the Hybris user account, which typically has access to the application's file system, database connections, and configuration files. Affected versions span SAP Commerce Cloud 6.4 through 1905, covering several years of product releases.
Frequently Asked Questions
What is CVE-2019-0344?
CVE-2019-0344 is a critical unsafe deserialization vulnerability in the virtualjdbc extension of SAP Commerce Cloud that allows unauthenticated remote code execution. Despite being disclosed in 2019, it was added to CISA's Known Exploited Vulnerabilities catalog in 2024 due to continued active exploitation, with a CVSS score of 9.8.
Why is a 2019 vulnerability still being actively exploited?
Many organizations running SAP Commerce Cloud have not applied the security patch due to the complexity of SAP upgrade cycles, custom code dependencies, and change management processes. Attackers actively scan for unpatched instances because the exploitation is straightforward using publicly available Java deserialization tools, and the targets contain high-value e-commerce and customer data.
What is the virtualjdbc extension?
The virtualjdbc extension provides a network-accessible virtual JDBC bridge in SAP Commerce Cloud that enables remote systems to perform database operations. It accepts serialized Java objects as part of its communication protocol, and the vulnerability exists because these objects are deserialized without proper type validation, allowing code injection.
Is my SAP Commerce Cloud installation affected?
You are affected if you are running SAP Commerce Cloud versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, or 1905 without SAP Security Note 2786035 applied. Check your installed version and patch level in the Hybris Administration Console, and verify whether the virtualjdbc extension is enabled in your deployment configuration.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.