Code injection vulnerability in WEBCUIF components, SAP security note 1484128

SAP security note 1484128, "Code injection vulnerability in WEBCUIF components", is a note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The F4 functionality in WEBCUIF and CRMUIF contains code that allows the execution of arbitrary simple Search Help not provided directly by an application through a normal V-Getter. If such a Search Help lacks a built-in authorization mechanism (e.g., a DDIC Search Help), execution is possible, and data is displayed to the originator of the request. However, data cannot be modified. Unauthorized display affects only master data and in limited cases where adding authorization checks within the Search Help is not feasible.

Solution

Apply the correction instructions attached to this note:

• WEBCUIF correction instructions
• CRMUIF correction instructions

Reason and prerequisites

You are running an application based on the WEB UI Framework: WEBCUIF or CRMUIF. An attacker familiar with the Search Help functionality in these frameworks can invoke an arbitrary DDIC Search Help and display, without authorization, the retrieved data. This leads to the exposure of master data, but the attacker cannot modify or compromise data integrity. A valid and authenticated user is required for this scenario.

References

• F4 help called through the CL_THTMLB_UTIL doesn’t work (Note 1510921)

Affected components

• CRMUIF 600
• WEBCUIF 700
• WEBCUIF 701
• WEBCUIF 730