CVE-2021-33690

What it actually does

This is a server-side request forgery vulnerability in the SAP NetWeaver Development Infrastructure Component Build Service affecting versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. An authenticated attacker with low privileges can send crafted requests that cause the Build Service to initiate arbitrary server-side network requests. Because those requests originate from the SAP server, the attacker may be able to reach internal-only services, localhost interfaces, cloud metadata endpoints, or trusted back-end systems that would not be directly reachable from the attacker’s network location. In worst-case deployments, especially where NWDI is internet-accessible, this can lead to sensitive data exposure, unauthorized interaction with internal services, integrity impact through unintended state-changing requests, and availability impact through request flooding or interaction with fragile internal endpoints.

Why it matters to the business

A compromised SAP NetWeaver Development Infrastructure system can expose source code, build artifacts, credentials, configuration data, and internal service details that support application development and deployment. Because NWDI is commonly connected to development pipelines and trusted internal infrastructure, successful exploitation can create a path to broader compromise of SAP landscapes or dependent applications. The high CVSS score, weaponized exploit maturity, and elevated EPSS score indicate meaningful exploitation risk even though the issue is not currently listed in CISA KEV. Business impact is highest where the Component Build Service is reachable from untrusted networks or where outbound server traffic is not tightly restricted.

How an attack unfolds

An attacker first obtains valid access to the SAP NetWeaver Development Infrastructure Component Build Service or another account capable of reaching the vulnerable build functionality. The attacker then submits crafted Build Service requests containing attacker-controlled destinations, URLs, or parameters that influence where the SAP server makes outbound requests. The vulnerable service processes the request and performs network activity on the attacker’s behalf from the SAP server. The attacker uses this behavior to probe internal network ranges, access localhost-only administrative services, retrieve cloud instance metadata, interact with internal APIs, or relay requests through the SAP server as a proxy. If sensitive endpoints respond, the attacker can collect secrets, configuration data, source/build information, or internal service responses; if state-changing endpoints are reachable, the attacker may also alter data or disrupt services. Repeated or targeted requests can further degrade availability by exhausting service resources or causing dependent systems to fail.

How to fix it

Apply the vendor-provided SAP security correction for CVE-2021-33690 through the applicable SAP Security Note and support package for SAP NetWeaver Development Infrastructure Component Build Service versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50. If no upgrade target is listed in asset data, consult SAP ONE Support Launchpad for the relevant Security Note and software component patch level for the installed release. Restrict access to NWDI and the Component Build Service to trusted administrative and build networks only; do not expose it directly to the internet. Enforce least-privilege access for NWDI users and service accounts. Disable or remove the Component Build Service if it is not required. Add egress controls so the SAP server cannot initiate arbitrary outbound HTTP, HTTPS, or other protocol connections; specifically block access to localhost-only services, cloud metadata IPs, internal management networks, and unnecessary RFC1918 destinations. Where feasible, route outbound traffic through an authenticated proxy with destination allowlisting and logging. Monitor and rate-limit unusual Build Service requests until patching is complete.

How to confirm the fix worked

Confirm the installed SAP NetWeaver Development Infrastructure component and support package level against the SAP Security Note or support package that remediates CVE-2021-33690. Verify that affected versions 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 have been patched or otherwise mitigated. Validate that the Component Build Service is not reachable from untrusted networks by performing external and internal exposure checks. Review firewall, proxy, and host egress policies to confirm the SAP server cannot reach arbitrary internal addresses, link-local metadata services, localhost endpoints, or unapproved external domains. Where safe and authorized, perform a controlled SSRF validation using a benign callback endpoint and confirm that the server no longer initiates attacker-controlled outbound requests. Confirm logging is enabled for SAP Java application logs, web access logs, reverse proxy logs, and outbound proxy/firewall events involving the SAP server.

Typical attack path

1. Identify an exposed SAP NetWeaver Development Infrastructure Component Build Service instance.
2. Authenticate with low-privileged credentials or abuse existing access to reach vulnerable Build Service functionality.
3. Submit crafted requests that cause the server to fetch attacker-specified internal or external resources.
4. Probe localhost, RFC1918 address ranges, internal DNS names, SAP-adjacent services, or cloud metadata endpoints from the server’s network position.
5. Extract returned data such as credentials, metadata, configuration files, service responses, source/build information, or internal topology details.
6. Use discovered secrets or reachable internal services to pivot, escalate access, alter data, or disrupt availability.
7. Clean up or blend activity into normal application traffic by using legitimate SAP application requests.

How to detect it

Look for evidence that the SAP NetWeaver Development Infrastructure server made unusual outbound requests shortly after inbound requests to Build Service functionality. Primary log sources include SAP Java application logs, SAP HTTP/access logs, reverse proxy or load balancer logs, web application firewall logs, DNS resolver logs, outbound proxy logs, host firewall logs, network flow records, and cloud metadata access logs where applicable. Hunt for requests containing full URLs, alternate URL schemes, encoded URLs, localhost references, link-local metadata addresses, internal IP ranges, or internal DNS names in parameters handled by NWDI or Build Service endpoints. Correlate inbound authenticated user activity with outbound connections from the SAP server to unexpected destinations, especially 127.0.0.1, ::1, 169.254.169.254, RFC1918 addresses, internal administration ports, or unfamiliar external domains. Investigate DNS lookups and HTTP requests from the SAP server that are not part of normal build operations. Review for repeated probing patterns across many ports, hosts, or URL schemes, which may indicate SSRF-based internal reconnaissance. If any suspicious outbound request returned data, assess whether secrets, source code, build artifacts, configuration files, cloud credentials, or internal service responses could have been exposed.

• 169.254.169.254
• latest/meta-data
• metadata.google.internal
• 169.254.169.254/latest/meta-data
• 169.254.169.254/metadata/instance
• 127.0.0.1
• localhost
• [::1]
• http://127.0.0.1
• http://localhost
• file://
• gopher://
• dict://
• ftp://
• @127.0.0.1
• @localhost
• %31%32%37%2e%30%2e%30%2e%31
• %6c%6f%63%61%6c%68%6f%73%74
• 10.
• 172.16.
• 192.168.
• /usr/sap/*/*/j2ee/cluster/server*/log/system/server*.log
• /usr/sap/*/*/j2ee/cluster/server*/log/defaultTrace*.trc
• /usr/sap/*/*/work/dev_server*

What your security team should do

• Prioritize patching or compensating controls because exploit maturity is weaponized and EPSS indicates elevated likelihood of exploitation.
• Immediately remove internet exposure for SAP NetWeaver Development Infrastructure and restrict Component Build Service access to trusted build and administration networks.
• Review all NWDI accounts and service accounts; revoke unnecessary access and rotate credentials if suspicious activity is found.
• Implement strict outbound egress allowlisting for SAP application servers, including explicit blocks for link-local metadata services, localhost, internal management ranges, and unsupported URL schemes.
• Search SAP application, reverse proxy, web access, firewall, DNS, and outbound proxy logs for SSRF patterns and unexpected server-initiated connections.
• Investigate any SAP server outbound traffic to cloud metadata endpoints, localhost, unusual internal IPs, or attacker-controlled domains following Build Service requests.
• If exploitation is suspected, preserve SAP Java logs, HTTP access logs, proxy/firewall logs, and memory/disk artifacts before remediation where operationally feasible.
• Assess whether exposed source code, build artifacts, credentials, signing keys, deployment secrets, or configuration files may have been accessed and rotate affected secrets.