Medium priority
SAP security note 1559700, "SQL Information Disclosure in RWB", is a program error note released on 13.09.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The Test Message tool in Runtime Workbench (RWB) displays an SQL Exception when invalid input is used while saving a test message. A malicious user can exploit this to discover database table and column names used by PI, potentially enabling more targeted attacks.
Solution
Apply the following Support Packages which include fixes for this security issue: PI 7.10 SP13, PI 7.11 SP07, PI 7.30 SP03.
For older Support Packages, a patch is available. Please update the software components of the Adapter Engine to the patch levels maintained in the "SP Patch Level" section of this note or use newer versions. Archives and the support package stack guide can be found on the SAP Service Marketplace.
References
- SAP Note 1615741: SAP Netweaver for PI 7.10 Support Package 13
- SAP Note 1570083: SAP EHP1 FOR SAP NETWEAVER PI 7.1 SP07
Affected components
- Basis Components > NetWeaver Process Integration (PI) > Integration Server > Runtime Workbench / Monitoring (BC-XI-IS-WKB)
Full note on SAP: SAP Support Launchpad note 1559700
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
