CVE-2022-22536

What it actually does

This vulnerability is an unauthenticated HTTP request smuggling/request concatenation flaw in SAP NetWeaver AS ABAP, SAP NetWeaver AS Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher. A front-end proxy, dispatcher, cache, or SAP HTTP component can disagree with the back-end SAP server about where one HTTP request ends and the next begins. By crafting ambiguous HTTP framing, an attacker can prepend attacker-controlled data to a subsequent victim request, causing the SAP application to process actions in the victim’s authenticated context, poison shared caches, bypass controls enforced at an intermediary, or disrupt service. Because exploitation is network-reachable, unauthenticated, low-complexity, and can cross security boundaries, the technical impact can include full compromise of confidentiality, integrity, and availability.

Why it matters to the business

Successful exploitation can allow an external attacker to hijack business transactions, access sensitive SAP data, alter records, poison web cache content served to users, or cause outages in critical SAP-facing services. The vulnerability is CISA KEV-listed, has a very high EPSS score, and is documented as actively exploited in the wild, so exposed internet-facing SAP systems should be treated as high-priority remediation targets. The CISA remediation deadline of 2022-09-08 has long passed, increasing audit, regulatory, and operational risk for any remaining unpatched exposure. The supplied package metadata references Alpine vim fixed in 9.0.0050-r0, which does not align with the SAP product vulnerability and should be validated as a scanner mapping issue rather than treated as the SAP remediation path.

How an attack unfolds

An attacker sends specially crafted HTTP requests to an affected SAP HTTP endpoint, SAP Web Dispatcher, reverse proxy path, or SAP application server interface. The malicious request uses ambiguous request boundaries so that the intermediary and back-end SAP component parse the traffic differently. The attacker’s partial request remains queued or is concatenated with the next legitimate user request. When a victim later sends an authenticated request over the same path or connection context, the SAP back end interprets the combined request as if attacker-controlled content belongs to the victim’s session. This can allow the attacker to trigger SAP functions as the victim, retrieve or modify application data, poison shared cache responses, or destabilize the service. Public exploitation has been observed, so exploitation attempts should be expected against internet-exposed SAP Web Dispatcher, ICM, NetWeaver, Content Server, and ABAP/Java application endpoints.

How to fix it

Apply the relevant SAP Security Notes and patches for CVE-2022-22536 across all affected SAP components, including SAP NetWeaver AS ABAP, SAP NetWeaver AS Java, ABAP Platform, SAP Content Server 7.53, SAP Internet Communication Manager, and SAP Web Dispatcher. Prioritize internet-facing SAP Web Dispatcher and application server endpoints first, followed by internal SAP HTTP interfaces reachable from untrusted networks. Ensure all SAP Web Dispatcher and application server instances in clustered or load-balanced deployments are upgraded consistently; a single unpatched node can remain exploitable. Where immediate patching is not possible, restrict external access to SAP HTTP endpoints, place systems behind a WAF or reverse proxy that normalizes HTTP requests, reject ambiguous requests containing both Content-Length and Transfer-Encoding, block duplicate Content-Length headers, disable unsafe connection reuse where applicable, and limit access to trusted source networks or VPNs. Review reverse proxy, CDN, and cache configurations to ensure they do not forward ambiguous HTTP framing to SAP back ends. Treat the listed Alpine vim fixed version 9.0.0050-r0 as unrelated to the SAP vulnerability unless independently confirmed by the scanner vendor; do not rely on a vim package update to remediate this SAP flaw.

How to confirm the fix worked

Confirm that every affected SAP component has the SAP vendor fix or applicable SAP Security Note implemented and that support package levels match SAP’s corrected versions for the deployed product line. Validate SAP Web Dispatcher, ICM, ABAP, Java, and Content Server versions from administrative interfaces and system information, not only from network scanner banners. Run an authenticated vulnerability scan or SAP-focused configuration assessment after patching. Perform a controlled request-smuggling test in a non-production or approved testing window to verify that ambiguous HTTP requests are rejected or normalized consistently by the front end and SAP back end. Check that WAF/reverse-proxy rules reject requests with both Content-Length and Transfer-Encoding, duplicate Content-Length, malformed chunked encoding, and concatenated HTTP requests. Review load-balanced pools to ensure no stale or unpatched SAP nodes remain in rotation. If a software composition or container scanner reports this CVE against Alpine vim, validate the finding manually because the affected product data is inconsistent with the SAP vulnerability description.

Typical attack path

1. Identify internet-facing SAP HTTP services, SAP Web Dispatcher, NetWeaver application servers, Content Server endpoints, or reverse-proxy paths exposing SAP applications.
2. Send probing requests that test for HTTP parser desynchronization, such as conflicting request length indicators, malformed transfer encoding, duplicate content lengths, or concatenated HTTP requests.
3. Confirm that the front-end and back-end components disagree on request boundaries by observing delayed responses, unexpected status codes, connection reuse anomalies, cache behavior, or request contamination.
4. Place attacker-controlled HTTP data into the request stream so it is prepended to a subsequent legitimate user request.
5. Wait for or induce a victim or service account to make an authenticated request through the same vulnerable path.
6. Cause the back-end SAP application to execute actions, retrieve data, alter state, poison cache entries, or disrupt availability under the victim’s context.
7. Maintain access or repeat the technique to target high-value SAP transactions, administrative endpoints, or sensitive application data.

How to detect it

To determine whether exploitation has already occurred, review logs from SAP Web Dispatcher, SAP Internet Communication Manager, SAP NetWeaver access logs, SAP Java/ABAP HTTP logs, reverse proxies, load balancers, WAFs, CDNs, and web caches. Look for ambiguous HTTP requests containing both Content-Length and Transfer-Encoding headers, duplicate Content-Length headers, malformed chunked encoding, unexpected request concatenation, multiple HTTP request lines in a single connection payload, abnormal connection reuse, and spikes in 400, 408, 411, 413, 502, or 503 responses. Correlate front-end proxy request IDs with SAP back-end logs to identify cases where the front end logged one request but the back end processed additional or different requests. Review SAP audit and application logs for sensitive actions performed by valid users immediately after malformed HTTP traffic from unrelated source IPs. Investigate cache anomalies such as users receiving another user’s content, unexpected redirects, altered pages, or inconsistent responses for the same URL. Because this vulnerability has been exploited in the wild, include historical lookback before the patch date, especially for internet-facing SAP Web Dispatcher and NetWeaver endpoints. Threat context should be treated as broad active exploitation of SAP HTTP request smuggling rather than attribution to a single named actor.

• Transfer-Encoding: chunked
• Content-Length: 0
• Transfer-Encoding.*Content-Length
• Content-Length.*Transfer-Encoding
• Duplicate Content-Length
• multiple Content-Length headers
• GET /sap/bc/
• POST /sap/bc/
• GET /sap/public/
• POST /sap/public/
• GET /irj/portal
• POST /irj/portal
• GET /sap/opu/odata/
• POST /sap/opu/odata/
• GET /sap/bc/gui/sap/its/webgui
• POST /sap/bc/gui/sap/its/webgui
• GET /sap/admin/
• POST /sap/admin/
• GET /ContentServer/ContentServer.dll
• POST /ContentServer/ContentServer.dll
• GET /sap/public/icman
• POST /sap/public/icman
• HTTP/1.1\r\nGET
• HTTP/1.1\r\nPOST
• 0\r\n\r\nGET
• 0\r\n\r\nPOST
• invalid Transfer-Encoding
• malformed chunked encoding
• request smuggling
• request concatenation
• ICMAD
• dev_icm
• dev_webdisp

What your security team should do

• Immediately inventory all internet-facing SAP Web Dispatcher, NetWeaver AS ABAP, NetWeaver AS Java, ABAP Platform, SAP Content Server, and SAP ICM HTTP services.
• Prioritize remediation as emergency/high severity because the issue is KEV-listed, actively exploited, unauthenticated, network-reachable, and has a very high EPSS score.
• Apply SAP vendor patches or Security Notes across all affected SAP components and verify every node in load-balanced or high-availability deployments.
• If patching cannot be completed immediately, restrict access to SAP HTTP services, enforce WAF/reverse-proxy normalization, and block ambiguous HTTP request framing patterns.
• Hunt historical logs for request-smuggling probes, parser desynchronization errors, unusual 400/408/502 responses, cache poisoning symptoms, and authenticated SAP actions from unexpected source IPs.
• Review SAP audit logs for sensitive transactions performed by legitimate users at unusual times, from unusual IP addresses, or immediately after malformed HTTP requests.
• Check reverse proxy, WAF, load balancer, SAP Web Dispatcher, and SAP ICM logs together because exploitation evidence may appear only when correlating front-end and back-end behavior.
• Validate any scanner result that maps this SAP vulnerability to Alpine vim, as that package association is likely inconsistent with the actual affected SAP products.
• Add SIEM detections for conflicting Content-Length and Transfer-Encoding headers, duplicate Content-Length headers, malformed chunked requests, and multiple HTTP request lines within a single request body.
• After remediation, perform targeted exposure validation from both external and internal network perspectives.