CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability

Description

CVE-2021-38163 is a security vulnerability in SAP NetWeaver Application Server (AS) Java that allows an authenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution (RCE).

The issue arises due to improper access controls in the Visual Composer Migration Service (com.sap.visualcomposer.VCParMigrator), which fails to properly validate file paths. An attacker can exploit this by:

• Path Traversal: Bypassing directory restrictions to write files outside intended locations
• JSP Upload: Deploying a malicious JavaServer Pages (JSP) file to execute arbitrary commands
• Authentication Bypass: In some configurations, leveraging weak session management to escalate privileges

Affected Versions

• SAP NetWeaver AS Java (versions before security patch updates in October 2021)

Impact

• Remote Code Execution (RCE): Execute OS commands with SAP system user privileges
• Information Disclosure: Access sensitive SAP configuration files
• Denial of Service (DoS): Disrupt service availability via malicious file uploads

Proof of Concept (PoC)

A functional exploit demonstrating the vulnerability: 🔗 https://github.com/purpleteam-ru/CVE-2021-38163

Mitigation

• Apply SAP Security Note #3089838 (SAP login required)
• Restrict access to /irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.VCParMigrator
• Implement network segmentation for SAP NetWeaver interfaces

References

• SAP Security Patch Day (Oct 2021)
• CVE-2021-38163 @ NVD

⚠️ Warning: Use only on authorized systems. SAP exploitation may violate security policies.