Hard-coded credentials in BC-CUS-TOL-NAV, SAP security note 1775422

SAP security note 1775422, "Hard-coded credentials in BC-CUS-TOL-NAV". Below are the symptom and SAP recommended solution.

Description

Symptom

BC-CUS-TOL-NAV contains code that changes the program’s behavior when a user is successfully authenticated with a certain user name. An attacker can be authenticated to BC-CUS-TOL-NAV without having their own legitimate credentials, or they may escalate privileges.

Solution

Please follow the steps mentioned in the manual instructions:

• Open transaction se37.
• Enter FM BM_REMOTE_INPUT_OUTPUT_LIST.
• From application menu select ’Delete’ or press SHIFT+F2.
• Save the changes in transport request and release it.

Reason and prerequisites

The program code contains a hard-coded user name that changes the system’s behavior if a user is successfully authenticated. The user may obtain additional information that should not be displayed.

The vulnerability is caused by a hard-coded user name and password combination in the program’s source code. An attacker who specifies these credentials can log on to the system without having been assigned legitimate access by the system administrator(s). If a user already has privileges with which they can log on, an escalation of privileges may be possible if the hard-coded account has higher access rights than the original user.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P