SAP security note 1922485, “Missing Whitelist Check in EHS-SAF-RCK and EHS-BD-TLS”, is a note. Below is the security information published by SAP for this note.
Description
Affected components
- Environment, Health, and Safety / Product Compliance > Basic Data and Tools > Tools (EHS-BD-TLS)
- EHS-SAF-RCK
Impact
The lack of a whitelist check allows unauthorized access to sensitive functions, which can be leveraged to gain elevated privileges within the system. This poses a significant security risk, especially in environments handling critical safety and compliance data.
Solution
To mitigate this vulnerability, implement the recommended support package or follow the correction instructions provided in the SAP Security Note. If you are utilizing the report RC1BOMBOS_FILL_FROM_LO and have customized it with your own function module, you must create a new environment parameter:
1. Navigate to IMG Activity: Specify Environment Parameters. 2. Create a new entry. 3. Insert BOMBOS_BOMDATA_GET in the Environment parameter field. 4. Enter your custom function module in the Value field. 5. Save the changes.
Additional information
- Release Status: Released for Customer on 20.11.2014
- Priority: Correction with medium priority
- Components Affected: EA-APPL versions 600 to 617
For more detailed information, refer to the SAP Security Note 1922485.
*Credits to Redrays.io for supporting information provided.*
Full note on SAP: SAP Support Launchpad note 1922485
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].