How does the SAProuter control who may connect, and how can it turn from a secure tunnel into an insecure proxy?

It creates a tunnel, usually on port 3299, and its access rules live in a file called the saprouttab, which lists which external hosts may connect through it to which internal systems. If those rules are maintained badly or use too many wildcards (the notorious P * * * * entry permits everything), unauthorised third parties can reach the SAP systems through it, often directly from the internet.

* The saprouttab decides who gets through; a single wildcard line turns the tunnel into an open proxy. *

The SAProuter's original purpose was to let SAP or other legitimate external parties reach a customer's landscape for maintenance through one port instead of many, with some extra controls. It has two modes: one that only passes SAP's own GUI protocol (DIAG) and a native TCP mode that lets most TCP protocols through (HTTP, Telnet, SSH and so on).

Public research has shown how a wide-open saprouttab, combined with weak SAP gateway settings, allowed remote exploitation of SAP systems, and over the years several SAProuter vulnerabilities were published (information disclosure, denial of service, a buffer overflow allowing remote code execution, password leaks). Recommended protections: run the latest version and patch often (edge servers tend to be forgotten), always combine it with a firewall, and encrypt its traffic with SNC (SAP's Secure Network Communications) or a VPN.

Go deeper:

• SAP Support — SAProuter — the vendor's own page on the component, its purpose and setup.