Potential disclosure or modification of data in SolMan, SAP security note 1475075

SAP security note 1475075, "Potential disclosure or modification of data in SolMan". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Note 1475075 addresses a critical SQL injection vulnerability in SAP Solution Manager (SolMan) that could allow unauthorized disclosure or modification of data.

A malicious user can exploit specially crafted inputs to modify, retrieve, or delete any data within the Solution Manager. This vulnerability arises from an SQL injection weakness where SQL statements are improperly assembled from strings. Attackers can manipulate these statements to execute arbitrary SQL commands with the privileges of the logged-in database user.

Solution

The vulnerability is automatically fixed in SAP Solution Manager 7.01 Support Package 25. For installations running Support Packages lower than 25, follow these steps:

• Create the SECURITY Log Object: use transaction SLG0 to create a subobject SECURITY with the subobject text “Log for SMSY Security Handling” for the object SMSY_LOG_OBJ.
• Extend the SMSY Options: extend the SMSY_OPTION domain via transaction SE11, adding the new option values SCUEXC_DIS (deactivation of the security check exception) and SCULOG_ENA (activation of the security check log); then include the new domain values in table SMSY_OPTIONS via transaction SM30.
• Implement Correction Instructions: follow the attached correction instructions provided in the SAP Note to activate security checks and logging. After implementation, security checks become active immediately, terminating processing if vulnerabilities are detected, and updating the application log via transaction SLG1.

CVSS

Score 0

References

Affected components

• Service > SAP Solution Manager > Solution Manager System Landscape (SV-SMG-SYS): ST 400