SAP Commerce (Hybris) Security: A Configuration Guide

Why is SAP Commerce (Hybris) security its own discipline?

SAP Commerce is not a single web application; it is a broad platform composed of Backoffice, HAC (Hybris Administration Console), the OCC REST API, the ImpEx import engine, media storage and Solr search — and each of these components is a separate attack surface. A deployment that hardens the storefront while leaving management consoles exposed is the equivalent of locking the door and leaving the window open.

The risk is real: known vulnerabilities

CVE-2019-0344 (CVSS 9.8): An unsafe deserialization flaw in SAP Commerce's virtualjdbc component allowed unauthenticated remote code execution. It remains the clearest example that critical flaws can appear even in the platform's core components.

CVE-2021-27602: A vulnerability that let an authorized user execute code on the server through the Backoffice reporting/scripting mechanism. The lesson: "authorized user" is not a security boundary; scripting privileges must be limited to the narrowest possible group.

SAP publishes security notes on the second Tuesday of every month (Patch Day). If an enterprise Commerce project has no process that tracks this calendar and applies critical notes within a defined window, its security is largely left to chance.

Attack surface map by component

Default accounts and installation leftovers

The best-known weakness in the Hybris ecosystem is operational rather than technical: going live with default administrator credentials. The default admin credentials of sample installations are public knowledge; combined with an internet-facing Backoffice, the result is a door that scanning bots will find within minutes. Mandatory pre-production steps: change or disable every default and demo user, purge initialpassword definitions from repository history, and exclude unused sample extensions from the production build.

HAC and Backoffice: close the management plane to the internet

HAC offers full system control, from flexible search to a script console; exposing it to the internet in production is not a defensible position. The correct architecture publishes management applications on a separate domain, reachable only from the corporate network or VPN, behind SSO and multi-factor authentication. On SAP Commerce Cloud (CCv2), endpoint access rules are managed in cloud configuration — but responsibility is shared: SAP operates the platform, you define the access policy.

OCC API: the storefront's invisible surface

In modern Hybris projects, mobile apps and SPAs run on the OCC REST API. Three critical points: OAuth 2.0 client definitions must not grant broader scopes than needed; DTO field configurations must be narrowed so customer data is not over-exposed; and anonymous endpoints need rate limiting and bot protection. Also verify that API documentation (Swagger etc.) is disabled in production.

ImpEx and scripting engines: power demands discipline

ImpEx scripting support and the Backoffice script console are powerful tools for operations teams — and the same power, combined with a compromised account, becomes a direct code-execution channel. In production, running script-bearing ImpEx files should be restricted, scripting privileges should be bound to a separate narrow role, and all imports should go through version-controlled files with an audit trail.

Business impact: in e-commerce, security is part of the sale

Commerce platforms process personal and order data; where card data is involved, PCI DSS applies. KVKK and GDPR breach notification duties are short-fused and the fines are concrete: the UK's ICO fined British Airways £20 million over the 2018 web-skimming card theft. Enterprise customers ask about your management-console access policy and patch process in vendor security reviews — the integrator who can answer with documentation moves ahead in the sales cycle.

Frequently asked questions

Can HAC be fully closed in production?

In many deployments, yes: opening HAC only during troubleshooting windows, from the internal network, is a common and healthy practice. If it stays permanently available, it must sit behind network restrictions and strong authentication.

How do I audit default accounts?

Regularly scan the user list against known defaults and demo users; report password change dates; verify that initialization/update processes do not load sample data into production.

Who applies patches on CCv2?

SAP manages the platform layer; libraries, customizations and configuration in your project code remain your responsibility. Tracking SAP security notes and planning the ones that affect your project is your team's job.

What should OCC token lifetimes be?

Access tokens should be short-lived (on the order of minutes); long sessions should rely on refresh tokens, and refresh tokens should be single-use/rotated.

Pre-production checklist

1. HAC and Backoffice closed to the internet; network restriction + SSO/MFA

2. All default and demo accounts disabled or credentials rotated

3. OCC OAuth clients narrowly scoped; DTO field exposure reviewed

4. Scripted ImpEx restricted in production; scripting privilege in a separate role

5. Type validation on media uploads; media served from a separate domain

6. Solr and internal services network-isolated

7. Monthly SAP security note review and a defined critical patch-time target

SSH Yazılım runs end-to-end security audits, hardening and continuous patch processes for SAP Commerce (Hybris) projects. Get in touch to benchmark your deployment against this checklist.