SAP Host Agent – sapstartsrv – OOB memory access in MsIGetProfileValue
Impact On Business
Remotely exploitable, without authentication, attacker could perform DOS against all sapstartsrv service. Lead to direct impact on availability for this service and signifiant availability issues for the SAP system.
Affected Components Description
The SAP Host Agent can accomplish several life-cycle tasks like : operating system monitoring, database monitoring, system instance control or upgrade preparation. Installed automatically during the installation of the new SAP system, it’s an OS independent and mandatory application.
Vulnerability Details
An Out-of-bounds write access exists in function MsIGetProfileValue() in sapstartsrv binary through the SAP Management Console service or the SAP Host Control service. If the challenge option is not provided to the GetSecNetworkId SOAP Web Service. The sapstartsrv tries to connect to the provided target system on the provided target port. The connection uses the SAP Message Server protocol and tries to challenge the service. The function calculates an offset address in memory directly using a part of the received packet, then uses this offset to write 0x00 into it. An attacker can craft a SAP Message Server receiver which responds with a malicious packet, then crash the sapstartsrv service. This web service is reachable through all ports handled by a sapstartsrv binary : 5xx13, 5xx14, 59813, 1128, 1129.
Solution
SAP has released SAP Note 3145702 which provides patched versions of the affected components.
The patches can be downloaded from https://launchpad.support.sap.com/#/notes/3145702.
Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.
Report Timeline
- 01/28/2022: Onapsis sends details to SAP
- 04/12/2022: SAP Provides update: In progress
- 05/10/2022: SAP releases SAP Note fixing the issue.
References
- Onapsis blogpost: https://onapsis.com/blog/sap-security-patch-day-may-2022-spring4shell-vulnerabi lity-has-been-patched-six-sap-applications
- CVE Mitre: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29616
- Vendor Patch: https://launchpad.support.sap.com/#/notes/3145702
Advisory Information
- Public Release Date: 07/17/25
- Security Advisory ID: ONAPSIS-2024-0010
- Researcher(s): Yvan Genuer
Vulnerability Information
- Vendor: SAP
- Affected Components:
- SAPHOSTAGENT 7.22 Patch 55 and lower
- SAP Kernel from 7.22 to 8.04
(Check SAP Note 3145702 for detailed information on affected releases)
- Vulnerability Class: CWE-532 CWE-522
- CVSS v3 score: 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Risk Level: Medium
- Assigned CVE: CVE-2022-29616
- Vendor patch Information: SAP Security NOTE 3145702
ABOUT OUR RESEARCH LABS
Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications.
Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.
Find all reported vulnerabilities at:
https://github.com/Onapsis/vulnerability_advisories
This advisory is licensed under a Creative Commons 4.0 BY-ND International License