SAP PO – SSRF with CR-LF injection in GRMG_WSRT
Impact on Business
A remote, unauthenticated attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability to send crafted HTTP requests from the vulnerable server. This could allow the attacker to discover internal open ports or access internal services, leading to a low impact on the confidentiality of the system and its business applications.
Vulnerability Details
A servlet within SAP Process Orchestration (PO) contains a Server-Side Request Forgery (SSRF) vulnerability combined with a Carriage Return Line Feed (CRLF) injection flaw. An unauthenticated attacker can leverage this vulnerability to inject arbitrary HTTP headers and craft complex requests. This allows the attacker to force the application to send requests to arbitrary destinations, potentially exposing internal network information or interacting with internal services that are otherwise inaccessible from the outside.
Solution
SAP has released SAP Note 3425188 which provides patched versions of the affected components.
The patches can be downloaded from https://me.sap.com/notes/3425188.
Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.
Report Timeline
- 01/08/2024: Onapsis reports vulnerability to SAP
- 04/09/2024: SAP issues the patch
References
Advisory Information
- Public Release Date: 09/17/2026
- Security Advisory ID: ONAPSIS-2026-0097
- Researcher(s): Yvan Genuer
Vulnerability Information
- Vendor: SAP
- Affected Components: SAP Process Orchestration (SAP PO) (Check SAP Note 3425188 for detailed information on affected releases)
- Vulnerability Class: CWE-918: Server-Side Request Forgery (SSRF)
- CVSS v3 score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- Risk Level: Medium
- Assigned CVE: CVE-2024-27898
- Vendor patch Information: SAP Security NOTE 3425188
Affected Components Description
- SAP Process Orchestration (SAP PO) 7.50
About our Research Labs
Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications. Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.
Find all reported vulnerabilities at: https://github.com/Onapsis/vulnerability_advisories
This advisory is licensed under a Creative Commons 4.0 BY-ND International License