SAP Security Note
High priority
SAP security note 1971516, "Code injection vulnerability in SV-SMG-SDD", is a program error note released on 18.06.2015. Below are the symptom and SAP recommended solution.
Description
Symptom
This security note has been updated. For more detailed information, see Security Note 2180264.
Service Data Download functionality contains code that permits the execution of arbitrary program code of the user’s choice. An attacker can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having legitimate credentials.
Solution
Implement the correction attached or upgrade to a newer support package.
Reason and prerequisites
The program code allows the definition and execution of user-defined code that changes the system’s behavior. A valid and authenticated user is required. Depending on the code, the user can:
- Inject and run their own code
- Obtain additional information that should not be displayed
- Modify data or delete data
- Modify the system’s output
- Create new users with higher privileges
- Perform a denial of service attack
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1971516
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].