CVE-2016-2386
SAP NetWeaver — SAP NetWeaver SQL Injection Vulnerability
Description
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2016-2386 appears on CISA KEV because SAP NetWeaver systems are frequently operated for years without systematic patch management, and the UDDI service is often inadvertently exposed to untrusted networks. The EPSS score of 71 % (99.4th percentile) places this vulnerability in the top fraction of all known CVEs by exploitation likelihood. Successful exploitation requires no authentication and yields arbitrary SQL execution against the underlying database — in SAP environments this typically means direct access to financial records, HR data, and core ERP transactions, making it a critical risk for NIS2-regulated and KRITIS organisations. Any organisation running SAP NetWeaver J2EE 7.40 without Security Note 2101079 and with ports 50000 or 50001 reachable from outside the SAP administration zone should treat this as a P1 incident regardless of the absence of a known ransomware campaign flag.
Runbook · Step 1
Immediate response (0-24 h)
- Apply SAP Security Note 2101079 immediately — this is the vendor-supplied fix for SAP NetWeaver J2EE Engine 7.40. Download via the SAP Support Portal (S-User required); confirm the installed version against the advisory after patching.
- Block the UDDI server endpoint at the perimeter firewall and on internal network segments: TCP port 50000 (HTTP) and 50001 (HTTPS). UDDI is rarely required in modern architectures; block by default and whitelist only if a documented business case exists.
- Treat all accounts with administrative privileges on the affected NetWeaver system as potentially compromised: rotate passwords immediately and invalidate active sessions (transaction SM04 / SMICM).
- Review ICM HTTP access logs and SMICM trace files retroactively for at least 90 days, looking for POST requests to
/uddior/UDDISecurityServicecontaining SQL metacharacters (',--,UNION,SELECT). - Reduce database permissions for the J2EE engine schema user (e.g. SAPSR3DB) to the minimum required — no DDL and no direct DML on system tables if not already enforced.
Runbook · Step 2
Mitigation layers
- Network segmentation: Restrict UDDI service access to the dedicated SAP administration network only. Terminate any direct internet-facing exposure on ports 50000/50001 via firewall ACL or security group rule.
- WAF/IPS rule: Inspect inbound HTTP requests targeting
/uddi*and/UDDISecurityService*for SQL injection patterns. Suggested Snort/Suricata rule:alert http any any -> $SAP_SERVERS [50000,50001] (msg:"CVE-2016-2386 SAP UDDI SQLi attempt"; content:"/uddi"; http_uri; pcre:"/(\%27|\'|--|\bUNION\b|\bSELECT\b)/i"; sid:2016238601; rev:1;). - IAM / least privilege: Restrict SAP roles granting access to the UDDI service (e.g.
UDDIAdministrator) to dedicated non-interactive service accounts; disable dialog logon for those accounts. - Database layer: Regardless of the SAP database backend (HANA, MaxDB, Oracle, MSSQL), restrict dynamic SQL execution and stored-procedure rights for the J2EE schema user; enable a database audit policy scoped to that user.
- SAP hardening: Configure ICM parameters
icm/HTTP/max_request_size_KBandicm/security_log; deploy SAP Web Dispatcher as a reverse proxy in front of the J2EE engine and enable URL filtering there.
Runbook · Step 3
Detection rules
- ICM / SAP Web Dispatcher access log: Requests to
/uddior/UDDISecurityServicereturning HTTP 200 or 500 with a non-zero response body, especially where the request contains URL-encoded SQL metacharacters (%27,%2D%2D,%55%4E%49%4F%4E). SPL:index=sap sourcetype=icm_access uri_path="/uddi*" (status=200 OR status=500) | search request="*%27*" OR request="*UNION*". - Database audit trail (HANA / Oracle): Unexpected SELECT statements against SAP system tables (
USR02,T000,MANDT) issued by the J2EE schema user. Sigma shape:title: SAP J2EE Schema User Unexpected System Table Access; logsource: product=sap_db; detection: selection: db_user: SAPSR3DB table_name|contains: [USR02, T000, MANDT]; condition: selection. - SAP system log (SM21): Message class
DBentries with database error codes (ORA-00933, SQL0104N, or equivalent) correlated with UDDI service calls — these indicate either failed or partially successful injection attempts. - Network telemetry (Zeek / Suricata): Connections from external or untrusted IP ranges to TCP 50000 or 50001 on SAP hosts. Zeek filter:
conn.log | where id.resp_p in {50000, 50001} && !id.orig_h in SAP_ADMIN_NETS. - EDR / process telemetry: Unexpected child processes spawned by the SAP J2EE engine process (
jstart.exe/jlaunch.exeon Windows;jstart/jlaunchon Linux) — shell spawning (cmd.exe,sh,bash) is a strong post-exploitation indicator.
Metrics
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/x_refsource_MISC
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlx_refsource_MISC
- https://www.exploit-db.com/exploits/39840/exploitx_refsource_EXPLOIT-DB
- https://github.com/vah13/SAP_exploitx_refsource_MISC
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/x_refsource_MISC
- https://www.exploit-db.com/exploits/43495/exploitx_refsource_EXPLOIT-DB
- http://seclists.org/fulldisclosure/2016/May/56mailing-listx_refsource_FULLDISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386government-resource