CVE-2021-21480

What it actually does

This vulnerability allows an authenticated SAP Manufacturing Integration and Intelligence (SAP MII) user with access to dashboard or developer functionality to cause attacker-controlled JSP code to be saved and executed by the SAP MII server. Because JSP executes server-side in the Java application container, the flaw can be used to run operating system commands with the privileges of the SAP MII application server process. Successful exploitation can lead to arbitrary file read, file modification, file deletion, deployment of web shells, privilege escalation within the application, and full compromise of the host running SAP MII.

Why it matters to the business

A successful compromise can give an attacker control over a system that often connects manufacturing, plant-floor, ERP, and operational data flows. This can expose sensitive production or business data, disrupt manufacturing visibility and integrations, alter dashboards or files used by operations, and potentially create a foothold for movement into connected SAP or industrial environments. The CVSS score is high and EPSS is elevated at approximately 0.51, indicating meaningful exploitation likelihood even though it is not currently listed in CISA KEV and no ransomware association is reported.

How an attack unfolds

An attacker first obtains valid low-privileged access to SAP MII, typically an account with permissions related to dashboard creation, SSCE, or developer functionality. The attacker then uses or intercepts a dashboard save/upload request and injects malicious JSP content before it is stored by the server. In one path, the malicious dashboard is later opened or processed under a role with sufficient SAP MII developer privileges, causing the JSP to execute server-side. In another path, an authenticated developer abuses the upload capability directly to place executable content that invokes operating system commands. Once execution is achieved, the attacker can run commands through Java runtime execution methods, read configuration and credential files, modify or delete application content, deploy a persistent JSP web shell, and use the SAP MII server as a pivot point to reach connected systems.

How to fix it

Apply the SAP security correction for CVE-2021-21480 to all affected SAP Manufacturing Integration and Intelligence deployments. If an exact fixed version is not available in asset inventory, validate remediation against the relevant SAP Security Note and installed SAP MII support package/patch level. Restrict access to SSCE, dashboard creation, and developer/upload functions to only trusted administrators. Remove unnecessary SAP_XMII Developer or equivalent high-risk roles from normal users. Block direct external access to SAP MII administrative and developer endpoints using network controls, VPN, reverse proxy policy, or application firewall rules. Review and remove untrusted custom JSP/dashboard content, especially content created shortly before patching. Ensure the SAP MII application server runs with least-privileged operating system rights and cannot write outside required application directories.

How to confirm the fix worked

Confirm the installed SAP MII component version and support package level includes the vendor fix for CVE-2021-21480. Test that unprivileged or ordinary authenticated users cannot save dashboard content as executable JSP, upload executable server-side code, or access developer-only functions. Attempt to submit benign JSP-like scriptlet content through dashboard save/upload workflows in a non-production test environment and verify it is rejected, neutralized, or stored as non-executable content. Review role assignments to confirm only authorized administrators have SAP_XMII Developer or equivalent privileges. From the server side, verify no unexpected JSP files, recently modified dashboard artifacts, or web shells exist in SAP MII application/content directories. Monitor that the Java application server process does not spawn operating system shells during normal dashboard use.

Typical attack path

1. Authenticate to SAP MII with an account that can access SSCE dashboard or developer features.
2. Create, save, or upload dashboard/application content intended to be stored as JSP or processed by the SAP MII server.
3. Modify the request in transit or directly submit crafted content containing malicious JSP scriptlets or command-execution code.
4. Trigger the saved dashboard or uploaded JSP so that the SAP MII application server compiles and executes the malicious JSP.
5. Execute operating system commands under the SAP MII application server account.
6. Read sensitive files, alter application content, delete files, deploy a persistent web shell, or pivot to connected SAP and manufacturing systems.

How to detect it

Review SAP NetWeaver Java and SAP MII logs for dashboard save, SSCE, Workbench, upload, or JSP access activity by unusual users or at unusual times. Important sources include HTTP access logs, SAP MII application logs, SAP NetWeaver defaultTrace files, security audit logs, reverse proxy/WAF logs, endpoint detection telemetry, and filesystem metadata on the SAP MII application server. Look for POST requests to SAP MII dashboard, SSCE, upload, Workbench, or JSP-related endpoints followed by access to newly created JSP files. Inspect newly created or recently modified JSP/dashboard files for Java scriptlets, Runtime.exec, ProcessBuilder, or shell command strings. On the host, hunt for child processes spawned by the Java application server such as cmd.exe, powershell.exe, sh, bash, curl, wget, net, whoami, or similar utilities. Investigate any outbound network connections from the SAP MII server that coincide with suspicious dashboard/JSP activity. Because exploitation may occur through authenticated workflows, correlate events with account role changes, SAP_XMII Developer assignments, and unusual activity from developer accounts.

• Runtime.getRuntime().exec
• java.lang.Runtime
• ProcessBuilder
• <%
• %>
• cmd.exe /c
• powershell.exe
• /bin/sh -c
• /bin/bash -c
• whoami
• net user
• wget
• curl
• SSCE
• .jsp
• SAP_XMII Developer
• /XMII/
• /XMII/Illuminator
• /XMII/Workbench

What your security team should do

• Prioritize patch verification for all internet-exposed or partner-accessible SAP MII systems because the vulnerability has high impact and elevated EPSS despite no current KEV listing.
• Inventory all SAP MII instances, including non-production systems, and map installed versions to the relevant SAP Security Note or vendor fixed support package.
• Immediately review and reduce SAP_XMII Developer, SSCE, dashboard-authoring, and file-upload privileges to the minimum required users.
• Hunt for suspicious JSP files, dashboard content containing Java scriptlets, and evidence of operating system command execution by the SAP Java server process.
• Restrict SAP MII administrative and developer interfaces to trusted networks and require strong authentication for all users with authoring or developer capabilities.
• Back up and integrity-check SAP MII application content, dashboards, and configuration files before and after remediation.
• If suspicious artifacts are found, preserve logs and JSP/dashboard files, isolate the server, rotate credentials accessible from SAP MII, and investigate connected SAP and manufacturing systems for lateral movement.