CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
Description
CVE-2022-22536 is an HTTP request smuggling vulnerability affecting multiple SAP products including SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server, and SAP Web Dispatcher. The vulnerability allows an unauthenticated attacker to prepend a victim's request with arbitrary data through HTTP request smuggling techniques, enabling the attacker to execute functions impersonating the victim or poison intermediary web caches. SAP systems are at the core of enterprise business operations worldwide, making this a critical threat to business continuity. CISA has added CVE-2022-22536 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.8% (99th percentile), exploitation is near-certain for exposed systems.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| sap | content server | 7.53 |
| sap | netweaver application server abap | 7.22; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; 7.87; 8.04; krnl64nuc_7.22; krnl64nuc_7.22ext; krnl64nuc_7.49; krnl64uc_7.22; krnl64uc_7.22ext; krnl64uc_7.49; krnl64uc_7.53; krnl64uc_8.04 |
| sap | web dispatcher | 7.22ext; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; 7.87 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://launchpad.support.sap.com/#/notes/3123396(Permissions Required)
- https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html(Broken Link, Not Applicable, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536(US Government Resource)
Weakness Type
CWE-444: HTTP Request Smuggling
CVE-2022-22536 exploits an HTTP request smuggling weakness in multiple SAP products, where front-end and back-end components interpret HTTP request boundaries differently. This inconsistency in parsing Content-Length and Transfer-Encoding headers allows an attacker to inject malicious requests that are processed by the back-end server as legitimate user requests, enabling session hijacking, cache poisoning, and unauthorized function execution.
Learn more: CWE-444 — Inconsistent Interpretation of HTTP Requests
Impact Analysis
CVE-2022-22536 poses a critical risk to enterprise SAP infrastructure. The vulnerability is remotely exploitable over the network without authentication, requiring no user interaction and involving low attack complexity. Through HTTP request smuggling, an attacker can impersonate legitimate users by prepending malicious data to their requests, gaining access to SAP business functions and sensitive data as the victim user. Additionally, the attacker can poison web caches, causing cached malicious content to be served to other users. This can lead to unauthorized access to SAP business transactions and financial data, execution of privileged SAP functions using stolen user sessions, cache poisoning attacks that affect all users accessing the system, and disruption of critical business processes running on the SAP platform. With an EPSS score of 93.8% (99th percentile), this vulnerability is among the most actively exploited across all known CVEs. The critical nature of SAP systems in enterprise environments amplifies the potential business impact significantly.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-22536 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 8, 2022. The EPSS score of 93.8% (99th percentile) reflects near-certain exploitation activity. The vulnerability was disclosed with a maximum CVSS score of 10.0 by security researchers, emphasizing its critical severity. HTTP request smuggling techniques are well-documented in the security community, and the SAP-specific exploitation vectors have been publicly analyzed. SAP users must authenticate to the SAP support portal to access the security patches. No specific ransomware campaigns are currently associated with this CVE, but unauthorized access to SAP systems provides attackers with access to critical financial and business data.
Remediation
- Apply SAP security patches immediately: Per the CISA KEV required action, apply updates per vendor instructions. SAP users must access patches through the SAP support portal (accounts.sap.com) — authentication is required. Apply the security notes that address the HTTP request smuggling vulnerability.
- Update SAP Web Dispatcher configurations: Review and harden SAP Web Dispatcher configurations to ensure proper handling of Content-Length and Transfer-Encoding headers, preventing request smuggling through the web layer.
- Implement WAF rules for HTTP request smuggling: Deploy Web Application Firewall rules specifically designed to detect and block HTTP request smuggling attempts, including inconsistent Content-Length and Transfer-Encoding headers.
- Restrict direct access to SAP application servers: Ensure that SAP application servers (NetWeaver ABAP, Java, Content Server) are not directly accessible from the internet. Route all traffic through properly configured reverse proxies or SAP Web Dispatcher instances.
- Monitor SAP system logs for suspicious activity: Review SAP security audit logs for signs of session hijacking, unauthorized function execution, or unusual user behavior patterns that could indicate exploitation of the request smuggling vulnerability.
Technical Details
CVE-2022-22536 is an HTTP request smuggling vulnerability affecting the HTTP processing layers of multiple SAP products. HTTP request smuggling occurs when front-end servers (such as SAP Web Dispatcher or reverse proxies) and back-end servers (such as SAP NetWeaver Application Servers) disagree on where one HTTP request ends and another begins. This disagreement typically arises from inconsistent handling of Content-Length and Transfer-Encoding headers in the same request. In the SAP context, an attacker can send a specially crafted HTTP request that is interpreted as a single request by the front-end but as two separate requests by the back-end. The second, smuggled request is then prepended to the next legitimate user request that arrives at the back-end, causing the server to execute it in the context of the victim user's session. This enables the attacker to execute SAP functions as the victim, access their session data, or manipulate cache contents. The vulnerability affects SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server, and SAP Web Dispatcher.
Frequently Asked Questions
Is CVE-2022-22536 being actively exploited?
Yes. CISA has added CVE-2022-22536 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.8% (99th percentile) indicates near-certain exploitation for exposed SAP systems. The vulnerability has a maximum CVSS score of 10.0.
What products are affected by CVE-2022-22536?
CVE-2022-22536 affects multiple SAP products: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server, and SAP Web Dispatcher. All organizations running these SAP components should apply patches immediately.
How do I fix CVE-2022-22536?
Apply the SAP security patches available through the SAP support portal (authentication required). Additionally, harden SAP Web Dispatcher configurations to properly handle HTTP headers and deploy WAF rules to detect request smuggling attempts. Ensure SAP application servers are not directly internet-accessible.
How severe is CVE-2022-22536?
CVE-2022-22536 is a critical severity HTTP request smuggling vulnerability with a maximum CVSS score of 10.0. With an EPSS score of 93.8% (99th percentile), it is among the most actively exploited vulnerabilities. Successful exploitation enables session hijacking, unauthorized function execution, and cache poisoning across critical SAP business systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.