CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
Description
CVE-2021-38163 is an unrestricted file upload vulnerability in SAP NetWeaver that allows an authenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution and full system compromise. By exploiting insufficient file type validation in the SAP NetWeaver platform, an attacker can upload web shells or malicious executables that are subsequently executed on the server. CISA has added CVE-2021-38163 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 84.8% (99th percentile), this SAP NetWeaver vulnerability represents a critical threat to enterprise environments running affected versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver | 7.30; 7.31; 7.40; 7.50 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://launchpad.support.sap.com/#/notes/3084487(Permissions Required)
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38163(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2021-38163 exploits an unrestricted file upload weakness in SAP NetWeaver, where the application fails to properly validate, restrict, or handle uploaded file types. This allows an attacker to upload files with dangerous content — such as JSP web shells or executable scripts — that can be executed on the server, providing direct code execution capabilities on the target SAP system.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2021-38163 is a critical vulnerability that can be exploited remotely by an authenticated attacker to achieve complete system compromise of SAP NetWeaver installations. The unrestricted file upload allows an attacker to place arbitrary content on the server, and if the uploaded file is a web shell or executable script, this translates directly to remote code execution. Confidentiality, integrity, and availability are all critically impacted — an attacker with code execution on an SAP NetWeaver server can access sensitive business data including financial records, HR information, and supply chain data, modify critical business processes, and disrupt SAP service availability. The EPSS score of 84.8% (99th percentile) indicates an extremely high probability of exploitation, making CVE-2021-38163 one of the most likely-to-be-exploited SAP vulnerabilities. Given that SAP NetWeaver is a foundation platform for many enterprise SAP deployments, a successful attack can cascade across the entire SAP landscape.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-38163 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 30, 2022. The EPSS score of 84.8% (99th percentile) reflects an extremely high exploitation probability, indicating that this vulnerability is being actively targeted by threat actors. While no specific ransomware campaigns have been publicly attributed to this vulnerability, the ability to upload and execute arbitrary files on SAP NetWeaver servers makes it a prime target for both financially motivated attackers and espionage groups targeting enterprise data. The relative simplicity of file upload exploitation — requiring only authenticated access and a crafted HTTP request — lowers the barrier to exploitation significantly.
Remediation
- Apply the SAP security patch immediately as directed by the CISA KEV catalog. Install the SAP Security Note that addresses CVE-2021-38163 on all affected SAP NetWeaver instances.
- Restrict file upload functionality by implementing server-side allowlists for permitted file types, validating file content using magic bytes rather than extension alone, and storing uploaded files outside the web-accessible root directory.
- Audit SAP NetWeaver server file systems for indicators of compromise, including unexpected JSP, PHP, or script files in web-accessible directories that may indicate web shell deployment.
- Implement network-level controls to restrict access to SAP NetWeaver administrative interfaces, ensuring that only authorized administrators from trusted networks can reach upload functionality.
- Enable comprehensive logging and monitoring on SAP NetWeaver instances, specifically tracking file upload events, unusual HTTP POST requests to upload endpoints, and execution of newly created files on the server.
Technical Details
CVE-2021-38163 is an unrestricted file upload vulnerability in SAP NetWeaver that stems from insufficient validation of files uploaded through the application's web interface. The platform fails to properly verify the type, content, and destination of uploaded files, allowing an authenticated user to upload files with dangerous extensions (such as .jsp, .war, or .exe) that can be executed by the application server. When a malicious file such as a JSP web shell is uploaded to a web-accessible directory, the SAP NetWeaver application server processes it as a legitimate server-side script, executing the attacker's code with the privileges of the SAP service account. The vulnerability requires authentication, meaning the attacker needs valid credentials or must chain this with an authentication bypass, but the relatively common availability of SAP user accounts in enterprise environments reduces this barrier.
Frequently Asked Questions
Is CVE-2021-38163 being actively exploited?
Yes. CISA has added CVE-2021-38163 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 84.8% (99th percentile) indicates an extremely high probability of exploitation. No specific ransomware association has been confirmed, but the vulnerability enables direct code execution on SAP servers.
What products are affected by CVE-2021-38163?
CVE-2021-38163 affects SAP NetWeaver, which is a core middleware platform underpinning many SAP enterprise applications. Organizations running vulnerable versions of SAP NetWeaver should consult the SAP Security Note for specific version and component details.
How do I fix CVE-2021-38163?
Apply the SAP Security Note patch that addresses CVE-2021-38163 on all affected SAP NetWeaver instances. Additionally, implement file upload restrictions including server-side file type allowlists, content validation, and storing uploads outside the web root. Audit existing server file systems for signs of web shell deployment.
How severe is CVE-2021-38163?
CVE-2021-38163 is a critical unrestricted file upload vulnerability with an EPSS score of 84.8% in the 99th percentile. Successful exploitation allows remote code execution on SAP NetWeaver servers, potentially compromising all business data and processes running on the affected SAP landscape. Its inclusion in the CISA KEV catalog underscores the urgency of remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.