SAP NetWeaver and Web Dispatcher HTTP Request Smuggling Vulnerability (CVE-2022-22536) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTSAP NetWeaver AS ABAP, AS Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher
Unauthenticated attackers can prepend arbitrary data to a victim's request, enabling session hijacking, cache poisoning, and complete compromise of system Confidentiality, Integrity, and Availability
Immediately apply the official SAP security patches (SAP Note 3123396) and restrict anomalous HTTP request headers at the reverse proxy or WAF level
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to SAP Note 3123396 to download and apply the appropriate kernel patches for your specific SAP environment.
# Check current SAP Web Dispatcher and Kernel versions
sapwebdisp -v
disp+work -v
# Extract and apply the downloaded SAP kernel patch using SAPCAR
SAPCAR -xvf KERNEL_PATCH.SAR2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, configure your reverse proxy or Web Application Firewall (WAF) to reject HTTP requests that contain both Content-Length and Transfer-Encoding headers, or disable HTTP pipelining.
# Example Nginx configuration to mitigate request smuggling
http {
# Reject invalid headers to prevent smuggling vectors
ignore_invalid_headers on;
# Custom rule to block requests containing Transfer-Encoding headers if necessary
if ($http_transfer_encoding ~* ".+") {
return 400 'Bad Request: Transfer-Encoding not allowed';
}
}3. Log Audit & IoC Verification Commands
Inspect HTTP access logs for anomalies such as unexpected HTTP 400 errors, or requests containing conflicting length headers.
# Scan access logs for requests containing both Content-Length and Transfer-Encoding
grep -i 'Transfer-Encoding' /usr/sap/logs/access_log | grep -i 'Content-Length'
# Identify high frequencies of HTTP 400 Bad Request responses which may indicate failed smuggling attempts
awk '$9 == 400 {print $1, $7}' /usr/sap/logs/access_log | sort | uniq -c | sort -nr | head -n 20Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-22536) is an HTTP Request Smuggling and Request Concatenation vulnerability in SAP NetWeaver Application Server and SAP Web Dispatcher. The root cause lies in the discrepancy in how frontend proxies and backend SAP application servers parse HTTP/1.1 request boundaries, particularly when handling requests containing both 'Content-Length' and 'Transfer-Encoding' headers. This parsing misalignment allows an attacker to smuggle a hidden request inside a legitimate HTTP stream.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker sends a specially crafted HTTP request stream to the target SAP system. The intermediary proxy (e.g., SAP Web Dispatcher) interprets the stream as a single request and forwards it, but the backend server (e.g., SAP NetWeaver AS) parses it as two distinct requests. The smuggled second request remains in the backend's connection buffer. When a legitimate user sends a subsequent request over the same connection, the backend prepends the smuggled request to the victim's request. This allows the attacker to execute unauthorized actions under the victim's session context or poison intermediary web caches.
3. Infrastructure & Business Impact
With a CVSS score of 10.0 and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk to enterprise environments. Successful exploitation can lead to a complete compromise of the system's confidentiality, integrity, and availability. Since SAP systems typically host critical business processes (ERP, CRM, HR), exploitation could result in massive data breaches, financial fraud, and severe operational disruption.
Official Vendor Advisories & References
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
Frequently Asked SecOps Questions (CVE-2022-22536)
FAQQ1. How critical is CVE-2022-22536 and is it actively exploited in the wild?
CVE-2022-22536 is rated CVSS 10.0 (CRITICAL) with a 30-day EPSS exploitation probability of 98.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-22536?
Primary impacted vendors include sap across netweaver_application_server_abap, netweaver_application_server_java, abap_platform, sap_content_server, web_dispatcher. Scope summary: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher
Q3. What temporary mitigations or workarounds exist for CVE-2022-22536 before patching?
[Mitigation] Immediately apply the official SAP security patches (SAP Note 3123396) and restrict anomalous HTTP request headers at the reverse proxy or WAF level Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-22536
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (sap)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.