Critical SAP Vulnerability: CVE-2023-40309

Have you heard about the note numbered CVE-2023-40309 with a severity of 9.8, announced by SAP at the October security patch day?

According to this note, SAP CommonCryptoLib does not perform the required authentication checks, which may result in missing or incorrect authorization checks for an authenticated user, leading to an escalation of privileges. Depending on the application and the level of privileges obtained, an attacker can abuse functions restricted to a specific group of users and read, modify, or delete restricted data.

Affected Versions

Almost all ABAP and Java Kernels (including S/4HANA) are affected. Here is the list of affected kernels:

• KERNEL 7.22
• KERNEL 7.53
• KERNEL 7.54
• KERNEL 7.77
• KERNEL 7.85
• KERNEL 7.89
• KERNEL 7.91
• KERNEL 7.92
• KERNEL 7.93
• KERNEL 8.04
• KERNEL64UC 7.22
• KERNEL64UC 7.22EXT
• KERNEL64UC 7.53
• KERNEL64UC 8.04
• KERNEL64NUC 7.22
• KERNEL64NUC 7.22EXT

As you can see, the list is extensive.

Corrective Steps

A hotfix has been published for dw_utils.sar and it must be applied to your system to address this vulnerability.

Detection and Prevention

The critical question is, if an attacker was exploiting this vulnerability in your system, do you use a product that could detect the suspicious actions of this user?