SAP security note 1471265, "Vulnerability during dynamic function call without validation". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability exists in the SAP Supplier Relationship Management (SAP SRM) solution, allowing unauthorized access to restricted SAP transactions at runtime. This can lead to:
- Manipulation of Business Logic resulting in inconsistent data states.
- Violation of Regulatory Compliance due to unprivileged access to critical business logic.
Solution
Implement the attached corrections or import the relevant support package.
Dynamic function calls are now validated using appropriate checks to prevent control by malicious users.
Reason and prerequisites
This is a program error caused by missing checks during dynamic calls to function modules from SRM programs. Malicious users can exploit this to control function calls, posing significant security risks.
Affected components
- SAP SRM 7.01
- SAP SRM 700
- SAP SRM 600
- SAP SRM 500
Full note on SAP: SAP Support Launchpad note 1471265
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].