Code injection vulnerability in Condition Mapping Program, SAP security note 1484089

SAP security note 1484089, "Code injection vulnerability in Condition Mapping Program", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Two function modules for condition data exchange (between ERP and CRM systems) contain code that allows the execution of arbitrary program code of the user’s choice. A malicious user can control the system’s behavior or potentially escalate privileges by executing malicious code without legitimate credentials. The programs cannot be called externally.

Solution

• Stop unnecessary report generation: unnecessary report generation has been halted.
• Add authorization checks: authorization checks have been added to the program where report generation is still required. Only users with condition generation authorization (authority object /SAPCND/CO with activity 64 for generation) can execute the program to generate report CND_MAP_DYN_GET_LIN.

Reason and prerequisites

The program code allows the definition and execution of user-supplied code, which changes the system’s behavior. A valid and authenticated SAP CRM user is required. Depending on the injected code, the user can:

• Inject and run their own code
• Obtain additional information not intended for display
• Modify or delete data
• Alter system output
• Create new users with higher privileges
• Perform a denial of service attack

The reports were used in CRM 3.0A release but became obsolete with CRM 4.0. Report generation is no longer required.

Affected components

• BBPCRM 400
• BBPCRM 500
• BBPCRM 520
• BBPCRM 600
• BBPCRM 700
• BBPCRM 701