Detect OAuth2 SSRF Attacks in SAP Logs & Network Traffic

This guide helps security analysts and SAP administrators identify Server-Side Request Forgery (SSRF) attacks targeting OAuth2 endpoints in SAP systems. You’ll learn where to look in SAP logs and network captures, what patterns indicate an attack, and how to respond. This assumes you have access to SAP system logs (e.g., via SAP NetWeaver Administrator or transaction SM19) and network traffic captures (e.g., tcpdump, Wireshark, or a SIEM).

What You’ll Need

• Access to SAP system logs (SM19, SM20, or SAP NetWeaver Administrator security audit log)
• Access to OAuth2 server logs (usually in the SAP Gateway or AS ABAP)
• Network traffic capture tools (Wireshark, tcpdump, or a SIEM with network logs)
• Basic knowledge of OAuth2 flows (authorization code, client credentials, etc.)
• Familiarity with SAP system architecture and common ports (e.g., 8000 for HTTP, 443 for HTTPS)
• Optional: threat intelligence feeds for known SSRF payload patterns

Step-by-Step

1. Understand the OAuth2 SSRF attack vector in SAP. In SAP, OAuth2 endpoints (like /oauth2/token or /oauth2/authorize) can be abused to make the server issue requests to arbitrary URLs. An attacker might manipulate the redirect_uri parameter or the client_id to point to internal services (e.g., http://169.254.169.254 for cloud metadata, or http://localhost:8000 for internal SAP services). The goal is to read sensitive data or scan internal networks.
2. Enable and configure SAP security audit logging. Go to transaction SM19 (Security Audit Configuration) and ensure that audit logging is active for your system. Enable logging for OAuth2 events, especially successful and failed login attempts, and any RFC calls. Also, enable logging for HTTP requests to the ICF (Internet Communication Framework) nodes that handle OAuth2.
3. Monitor SAP security audit logs (SM20). Use transaction SM20 to view audit logs. Look for entries with event IDs related to OAuth2, such as OAuth2 or HTTP. Pay attention to unusual patterns: multiple requests to the same endpoint with varying redirect_uri values, or requests from unexpected IP addresses.
4. Check the OAuth2 server logs. In SAP NetWeaver, OAuth2 server logs are typically written to the system trace (transaction ST22) or to the ICF logs (transaction SICF -> right-click on the OAuth2 service -> Display Logs). Look for entries where the redirect_uri parameter contains internal IP addresses, localhost, or cloud metadata IPs (169.254.169.254). Also check for client_id values that are not registered in your system.
5. Inspect ICF access logs. In transaction SICF, find the OAuth2 service node (usually under default_host/sap/bc/oauth2). Right-click and choose ‘Display Logs’ to see HTTP requests. Look for requests with unusual query parameters, especially redirect_uri that contains http:// or https:// to non-approved domains, or URLs with encoded characters (e.g., %2F%2F for //).
6. Capture and analyze network traffic. Use tcpdump or Wireshark on the SAP application server to capture traffic to and from the OAuth2 endpoint. Filter for HTTP requests to the OAuth2 path. Look for requests where the redirect_uri parameter points to an internal IP or a non-standard port. Also, watch for responses that contain data from internal services (e.g., cloud metadata JSON).
7. Look for SSRF patterns in URL parameters. Common SSRF payloads include: http://127.0.0.1, http://localhost, http://169.254.169.254, http://metadata.google.internal, or URLs with @ to bypass filters (e.g., http://expected.com@internal.com). In SAP logs, these might appear URL-encoded.
8. Correlate logs with network traffic. When you find a suspicious log entry, trace the session ID or client IP in the network capture to see the full request and response. This helps confirm if the server actually made an outbound request to the internal target.
9. Check for outbound connections from the SAP server. On the SAP server, use netstat or a network monitoring tool to see if there are outbound connections to unusual internal IPs or ports (e.g., 25, 3306, 6379) that could indicate SSRF-driven port scanning.
10. Set up alerts in your SIEM. Create correlation rules that flag OAuth2 requests with redirect_uri containing internal IPs, localhost, or known cloud metadata IPs. Also flag multiple requests from the same client with different redirect_uri values, which suggests parameter manipulation.

Common Mistakes

• Only checking the audit log. SSRF attacks often leave traces in multiple places (ICF logs, network traffic). Relying on one source can miss the attack.
• Ignoring URL-encoded payloads. Attackers encode characters to bypass filters. Always decode URL parameters before analysis.
• Not monitoring outbound traffic. The SSRF request goes from the SAP server to the internal target. If you only monitor inbound requests, you’ll miss the actual attack.
• Assuming OAuth2 logs are only in the security audit log. OAuth2 events may be logged in the system trace or ICF logs, not just the security audit log.

Tips

• Use a SIEM with SAP connectors. Tools like Splunk or QRadar can ingest SAP logs and network flows, making correlation easier.
• Regularly review your OAuth2 client registrations. Remove any unused or suspicious clients. An attacker might use a compromised client to launch SSRF.
• Implement allowlists for redirect URIs. In SAP, you can restrict the redirect URIs allowed for each OAuth2 client. This is the most effective defense against SSRF via redirect_uri.
• Keep your SAP system patched. SSRF vulnerabilities in SAP OAuth2 have been patched in security notes. Apply them promptly.
• Use network segmentation. Limit the SAP server’s ability to reach internal services. This reduces the impact of an SSRF.

Troubleshooting

• No logs found. If you don’t see OAuth2 logs, check that audit logging is enabled for the relevant events. Also, ensure you’re looking at the correct system (production vs. dev).
• Logs are too verbose. If you’re overwhelmed by logs, use filters in SM20 or your SIEM to focus on OAuth2-related events and error codes (e.g., HTTP 400, 403).
• Network capture doesn’t show the SSRF. The outbound request might be encrypted (HTTPS) or go through a proxy. Ensure you’re capturing on the right interface and consider decrypting TLS if you have the keys.
• Suspicious entry turns out to be legitimate. Some internal services may legitimately use the OAuth2 endpoint with internal redirect URIs. Verify with the application owner before raising an incident.
• Can’t find the ICF log. In SICF, you may need to enable logging for the specific service node. Right-click the node, choose ‘Change’, and set ‘Log’ to ‘All’ or ‘Errors’.

Frequently Asked Questions

Q: What is the most common sign of an OAuth2 SSRF attack in SAP?
A: The most common sign is an OAuth2 request with a redirect_uri parameter pointing to an internal IP address, localhost, or cloud metadata service (e.g., 169.254.169.254).

Q: Can I detect SSRF using only the SAP audit log?
A: Yes, but only if you have enabled detailed auditing for OAuth2 and HTTP events. However, you’ll also need network traffic to see the outbound request and response.

Q: How can I prevent SSRF in SAP OAuth2?
A: The primary prevention is to configure strict allowlists for redirect URIs for each OAuth2 client. Also, apply SAP security notes that fix known SSRF vulnerabilities.

Q: What should I do if I find a suspicious entry?
A: Immediately isolate the affected client, block the source IP, and investigate the outbound connections from the SAP server. Then, review your logs to determine if any internal data was exfiltrated.

Q: Are there specific SAP transactions to check?
A: Yes, use SM19 (security audit config), SM20 (audit log display), SICF (ICF service logs), and ST22 (system trace). For network, use tcpdump or Wireshark.

Q: Does SAP provide any built-in SSRF detection?
A: SAP does not have a dedicated SSRF detection tool, but you can configure the security audit log and use the ICF logs to capture relevant events. Many organizations use a SIEM to correlate these logs.

Related

• Identify Fonts on a Webpage: 5 Quick Ways
• Squadron 42: What to Know Before You Play
• Reverse Text String: How to Do It & Why