ICM2SHELL is a memory corruption bug in how the SAP Kernel reassembles fragmented WebSocket messages, code that the ICM and Web Dispatcher share [2]. Onapsis says exploitation needs no credentials, user interaction or misconfiguration, because WebSocket is on by default and some default S/4HANA services accept WebSocket connections without authentication. It leads to code execution as the system's administrator account or to a crash [2]. Onapsis says it built a working end-to-end exploit, and because the ICM and Web Dispatcher are built to face the internet, many deployments can be attacked from outside the corporate network [2]. Systems on kernel 7.40 or later are affected, including the Web Dispatcher embedded in SAP HANA XS; Java-only systems are not [2].
PROXYGATE tricks SAP Gateway into treating an unauthenticated outside attacker as one of the system's own application servers, letting the attacker run operating system commands [3]. Onapsis says the kernel patch alone is not enough: administrators also need to tighten the gateway's proxy access list or set the new gw/acl_mode_proxy parameter, because the shipped default allows all connections [3]. For both bugs, several out-of-maintenance kernels are affected and must be upgraded rather than patched [2][3].
