CVE-2021-33690 Server-side request forgery in SAP NetWeaver Development Infrastructure (Component Build Service)
An attacker with server access can perform SSRF attacks to compromise sensitive data and impact availability in SAP NetWeaver NWDI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-33690?
CVE-2021-33690 is a critical server-side request forgery vulnerability in SAP NetWeaver Development Infrastructure (Component Build Service), published on 15 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet.
Weakness: CWE-918
Which versions are affected by CVE-2021-33690?
It affects 1 product.
Products include Sap Netweaver Development Infrastructure.
How do I fix CVE-2021-33690?
No fix has been published for CVE-2021-33690 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-33690 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-33690 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in SAP NetWeaver Development Infrastructure (Component Build Service)
Sources
Also known as GHSA-76pj-fv2h-qvfg.