CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability

CVE-2022-22536 is an HTTP request smuggling vulnerability affecting multiple SAP products, including SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server, and SAP Web Dispatcher. An unauthenticated attacker can abuse how these components parse HTTP requests to prepend arbitrary data to a victim’s request. That can lead to actions executed as the victim or to poisoning of intermediary web caches. For organizations running SAP internet-facing or reverse-proxied stacks, this matters because it can undermine authentication boundaries and cache integrity without needing valid credentials.

Public detail is limited to the products and behavior described in the advisory material; exact version ranges, scores, and exploit mechanics must be confirmed against the vendor advisory. CISA’s required action is to apply updates per vendor instructions. Ransomware use is not documented for this CVE.

How it works

This issue falls under CWE-444: inconsistent interpretation of HTTP requests between components in a chain (commonly called HTTP request smuggling). When a front-end component (for example a web dispatcher, reverse proxy, or load balancer) and a back-end application server disagree on where one request ends and the next begins—often because of ambiguous handling of headers such as Content-Length or Transfer-Encoding—an attacker can craft a request that the front end treats as one message and the back end treats as two (or more).

According to the available summary, an unauthenticated attacker can prepend a victim’s request with arbitrary data. In practical terms for this class of flaw, that can allow the attacker’s payload to be processed in the security context of the subsequent legitimate request, enabling function execution that impersonates the victim, or it can leave crafted responses in shared caches so later users receive attacker-controlled content. Exact request shapes and which hop is desynchronized are not provided here; treat any public proof-of-concept as untrusted until validated against your own stack and the vendor advisory.

Am I affected? How to find it in your systems

Inventory systems that run or front the named SAP components: NetWeaver Application Server ABAP, NetWeaver Application Server Java, ABAP Platform, SAP Content Server, and SAP Web Dispatcher. These often appear in ERP, CRM, portal, and content-delivery architectures, sometimes behind corporate reverse proxies or load balancers that terminate TLS and forward HTTP.

• Build an asset list from CMDB, software inventory, SAP Solution Manager or equivalent landscape tools, and network scans for SAP-related ports and HTTP(S) services that identify as SAP or Web Dispatcher.
• Record full product and patch-level information for each instance; compare only against the vendor’s fixed versions and notes for CVE-2022-22536—do not rely on third-party version lists alone.
• Map the HTTP path: which components terminate client connections, which forward requests, and whether shared or intermediary caches sit in front of SAP. Smuggling risk is highest where multiple parsers sit in series.
• For exploitation signs, review reverse-proxy, Web Dispatcher, and application HTTP access logs for anomalous request framing (unusual header combinations, unexpected concatenated requests, or cache-key anomalies). Correlate with authentication or business-function logs for actions that do not match the apparent user session. Telemetry will vary by product; confirm useful log fields in SAP and proxy documentation.

If you cannot determine patch level or topology quickly, assume exposure until the advisory comparison is done, especially for internet-reachable or partner-facing entry points.

How to remediate

Patch first. Apply the updates SAP provides for the affected products, following the vendor instructions referenced by CISA. Schedule maintenance for NetWeaver AS ABAP/Java, ABAP Platform, Content Server, and Web Dispatcher instances in scope, and verify post-update build levels against the advisory.

• After patching, re-validate the full request path (dispatcher/proxy to application) so front-end and back-end parsing behavior remain consistent with vendor guidance.
• Harden HTTP handling for this class of weakness: prefer configurations that reject ambiguous framing, disable unnecessary HTTP methods and features on the dispatcher and application, and ensure only required headers are accepted at the edge.
• Review cache configuration on any intermediary so that authenticated or sensitive responses are not cached in ways that smuggling could poison; prefer cache keys and vary rules that align with SAP and proxy best practices.
• Restrict administrative and high-privilege SAP functions to trusted networks and strong authentication so that any residual request-desync impact is limited.

Document the change window and retain evidence of advisory review and applied fixes for audit and compliance.

If you can't patch immediately

Reduce exposure until updates can be installed. Compensating controls do not replace the vendor fix but can lower likelihood and impact of smuggling against this product class.

• Network segmentation and access control: limit who can reach Web Dispatcher and application HTTP ports; prefer VPN or zero-trust access for users and block direct internet exposure where business allows.
• Edge filtering / virtual patching: if you operate a WAF or reverse proxy in front of SAP, enable rules that normalize or reject ambiguous Content-Length / Transfer-Encoding combinations and oversized or malformed request lines—tune in monitor mode first to avoid breaking legitimate SAP clients, then enforce. Confirm rule coverage with your WAF vendor; do not assume generic rules fully address this CVE.
• Feature reduction: disable unused virtual hosts, entry points, and HTTP options on Web Dispatcher and the application servers; reduce the attack surface of request parsers.
• Cache isolation: bypass or tightly control caching for authenticated SAP paths until patched.
• Heightened monitoring: alert on desync-like patterns in proxy and SAP logs, sudden cache inconsistencies, and business actions from sessions that do not match normal client behavior. Retain logs long enough for incident review.

Track the exception with a clear deadline to patch, and reassess if the systems become targeted or if new vendor guidance appears.

If your data may have been exposed

Actively exploited vulnerabilities can lead to account takeover, unauthorized business-function execution, or secondary compromise, even when ransomware use is not documented for this CVE. If you have indicators of exploitation or cannot rule out exposure on internet-facing SAP entry points, follow your incident-response process: isolate affected paths, preserve logs, rotate credentials and sessions for potentially impersonated users, and assess whether sensitive data or transactions were accessed.

As a further check on whether identities tied to your environment appear in known breach datasets, you can run a free exposure scan of your email addresses against aggregated breach records and then prioritize password resets and monitoring for any confirmed hits.