Code injection vulnerability in CRM-MKT-EAL, SAP security note 1902162

SAP security note 1902162, "Code Injection Vulnerability in CRM-MKT-EAL", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

CRM-MKT-EAL contains code that permits the execution of arbitrary program code of the user’s choice. An attacker can control the behavior of the system or potentially escalate privileges by executing malicious code without having legitimate credentials.

Solution

With the correction of this note, the following changes are made to the process of creating and using mapping formats in external list management:

Authorization Enhancements

• Mapping rules of type ‘Code’ can now only be edited or activated if the user has the necessary authorizations.
• Users must have authorization S_DEVELOP for object type MFCD, object name MF_CODE, and activity 02 to enter ABAP code.
• Activation of mapping rules of type ‘Code’ requires authorization CRM_MAP_FM with activity 63.

Process Changes

• The Edit button for mapping rules is now only enabled for authorized users.
• An Activate button has been added to ensure that only active mapping rules can be used for uploading external lists.
• Existing mapping formats with mapping rules of type ‘Code’ will become inactive after implementing this note and need to be manually activated.

Side effect: after implementing this note, existing mapping formats with mapping rules of type ‘Code’ will become inactive and must be manually activated. Ensure that users activating these rules have the appropriate authorizations.

Reason and prerequisites

The program code allows defining and executing user-defined code that changes the system’s behavior. A valid and authenticated user is required. Depending on the code, a user can:

• Inject and run their own code
• Obtain additional information that should not be displayed
• Modify or delete data
• Modify the system’s output
• Create new users with higher privileges
• Perform a denial of service attack