Code injection vulnerability in TH_GREP, SAP security note 1580017

SAP security note 1580017, "Code injection vulnerability in TH_GREP", is a program error note released on 12.08.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The function module TH_GREP contains code that permits the execution of operating system commands of the user’s choice. A malicious user can control the system’s behavior or potentially escalate privileges by executing malicious commands without having legitimate credentials.

Solution

Please apply the corrections attached to this note.

Reason and prerequisites

The program code allows the definition and execution of user-defined code that alters system behavior. A valid and authenticated SAP system user is required. Depending on the code, the user can:

• Execute arbitrary operating system commands
• Obtain additional information that should not be displayed
• Modify or delete data
• Modify system output
• Perform a denial of service attack

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• Update #1 for Security Note 1580017
• Potential information disclosure relating to FM TH_GREP
• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730