SAP Security Note
High priority
SAP security note 1795103, “Code Injection Vulnerability in DMIS Component”, is a program error note released on 18.04.2013. Below are the symptom and SAP recommended solution.
Description
Symptom
This security note has been updated. For more detailed information, see Security Note 1847764. The Add-On DMIS contains code that permits the execution of arbitrary program code of the user’s choice. Add-On DMIS is also used in the SAP LT Replication Server. An attacker can control the system’s behavior or potentially escalate privileges by executing malicious code without legitimate credentials.
Solution
Implement the correction instructions in all affected systems (i.e., all systems containing the DMIS software component). The attached notes describe corrections of user roles and authorizations, particularly in the context of HANA data replication. It is essential to implement the respective note(s) if you are using the respective scenario.
Reason and prerequisites
The program code allows defining and executing user-defined code that alters system behavior. A valid and authenticated user is required. Depending on the code, the user can:
- Inject and run their own code
- Obtain additional information that should not be displayed
- Modify or delete data
- Alter system output
- Create new users with higher privileges
- Perform a denial of service attack
CVSS
Score 0
References
Full note on SAP: SAP Support Launchpad note 1795103
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
