Missing Authentication Check in SAP Commerce Cloud Configuration Upload
SAP Commerce Cloud
Unauthenticated RCE on an internet-facing e-commerce platform is the worst possible combination. The required rebuild and redeployment makes this operationally significant, but the alternative is leaving the door open. If you run SAP Commerce Cloud, treat this as a P0.
Vulnerability Detail
An overly permissive Spring Security configuration with incorrect rule ordering allows unauthenticated users to access the configuration upload functionality. An attacker can upload malicious configuration that triggers code injection, resulting in arbitrary server-side code execution. The fix requires a rebuild and redeployment of the affected application.
Workaround
Restrict network-level access to the configuration upload endpoints until the rebuild and redeployment is complete.
Patch Action
Apply SAP Note 3733064. Note: requires a full rebuild and redeployment of SAP Commerce Cloud — coordinate with your DevOps team.
Affected Versions
Patch Info