SAP security note 1423059, "Security Fixes for SRM Analysis Cockpit Tool", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Security Note 1423059 addresses a critical vulnerability in the SRM Analysis Cockpit Tool, part of the SAP Supplier Relationship Management (SAP SRM) solution. This vulnerability allows for dynamic function call injections, which can lead to severe security breaches.
A vulnerability exists in the SRM Analysis Cockpit Tool that allows hackers to inject malicious code at runtime using dynamic function calls. This can result in:
- Crash of the SAP application server
- Disruption of business logic, leading to inconsistent data states
- Manipulation of business logic, granting unprivileged access to restricted functionalities
- Potential violation of regulatory compliance due to unauthorized access to critical business logic
Solution
Implement the attached corrections provided in the security note. The solution involves validating dynamic function calls against a predefined set of entries in a customizing table to prevent unauthorized execution of function modules.
Reason and prerequisites
This issue is a program error caused by unchecked dynamic function calls in ABAP. While dynamic function calls enhance code flexibility and reusability, they pose significant security risks if not properly validated against user input.
References
Affected components
- SAP SRM 5.0
- SAP SRM 6.0
- SAP SRM 7.0
- SRM_SERVER: Versions 550, 600, 700
Full note on SAP: SAP Support Launchpad note 1423059
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
