Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Sending sales data to SAP DM, SAP security note 1474431

SAP Note 1474431
SAP Security Note
High priority

SAP security note 1474431, "Sending sales data to SAP DM", is released on 09.11.2010. Below are the symptom and SAP recommended solution.

ComponentSAP Business Warehouse > BW only – Business Content and Extractors > BW only – Retail and Consumer Products
PriorityCorrection with high priority
TypeSAP Security Note
StatusReleased for Customer
Released on09.11.2010

Description

Symptom

This security note addresses critical issues related to sending sales data to SAP Demand Management (SAP DM) using process chains:

  • Security Vulnerability: A security hole allows malicious attackers to obtain read access to specific SAP system tables via remote function calls or send open hub destination data to unintended receiver systems.
  • Undefined Process Chain Status: If the open hub destination is empty, no corresponding message is written to the application log, resulting in an undefined status of the process chain.
  • Program Terminations: Enabling "Parallel Processing" and executing the process chain synchronously may lead to a program termination with the error CALL_FUNCTION_REMOTE_ERROR ("Maximum number of sessions reached"). Setting "Parallel Processing" can also cause a program termination of type DYNPRO_SEND_IN_BACKGROUND.
  • System Error Messages: Using the "Technical Key" option for the open hub destination can trigger the error message /RTF/K 048 "Partitioning field not specified".
  • Data Sending Errors: Sending data with completely initial quantity or amount fields leads to error messages if essential fields like currency key or unit field are not filled.

Solution

Implement the correction instructions provided in SAP Note 1474431 to address and resolve the identified security vulnerabilities and program errors.

Reason and prerequisites

A program error introduces a security vulnerability that allows unauthorized reading from database tables with specific structures. The affected tables must meet the following criteria:

  • Field Requirements: Must have a field named LOCATION_INT or LOCATION_EXT (character-type). Must have at least one of the following fields: CALWEEK, CALMONTH, CALYEAR (character-type), or DATEFROM (date-type).
  • Additional Accessible Fields: DATETO (date), PRODUCT_INT, PRODUCT_EXT, PROMO_INT, PROMO_CREANO, PROMO_MEDIATYPE, PROMO_OFFERTYPE, PROMO_CUSTTYPE (all character-type), SALES_QTY, SALES_RTL, SALES_TAX, SALES_CST (packed number, type P), SALES_QTY_UNIT, SALES_RTL_CUKY, SALES_TAX_CUKY, SALES_CST_CUKY (character-type).

If these fields are present but have differing data types, a runtime error occurs.

References

Full note on SAP: SAP Support Launchpad note 1474431

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#BW #Retail and Consumer Products #Business Content and Extractors

Explore More