Hard-coded credentials in eCATT, SAP security note 1729638

SAP security note 1729638, "Hard-coded credentials in eCATT", is a security note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A critical security vulnerability has been identified in the eCATT tool where hard-coded user names and passwords/credentials are present in the program’s source code. This flaw allows an attacker to authenticate to eCATT without legitimate credentials or potentially escalate privileges if the hard-coded account has higher access rights.

Solution

Apply the Security Note:

• Remove hard-coded credentials from all affected sources.
• Update to the latest version of report ECATT_GENERATE_ET_USER to configure username and password securely.

Manual Post-Implementation Steps

Maintain Selection Texts:

• Start transaction SE38.
• Enter the report name ECATT_GENERATE_ET_USER and display it.
• Navigate to Goto -> Text elements -> Selection texts.
• Switch to edit mode and set the flag "Dictionary" for parameter P_UNAME.
• Update remaining parameter texts as follows: P_PWD: Password; P_PWD2: Password (confirmation).
• Save, assign transport request, and activate.

Maintain User Accounts for External Test Tools:

• Start transaction SU01.
• Delete or lock user ECATT_ET_USR.
• Execute report ECATT_GENERATE_ET_USER via transaction SE38 or SA38.
• Enter a new username and password that comply with your company’s password policies.
• Execute the report to create the user account for external test tools.

Update Table Entries:

• Start transaction SE16 and enter table name RSECACHK.
• Create a new entry with the following data: PROGNAME: ECATT_GENERATE_ET_USER; CHSUM: 8E016678B78844FD3223383B98A94307; PREFIX (for SAP_BASIS 700 and higher): /ECATT/ET_USR/.
• Save the data and add the entry to a transport request.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• SAP Note 1906171

Affected components

• SAP_BASIS 620 to 731