Potential modification of persisted data in SAP CPQ Solution Configuration (SME), SAP security note 2147745

SAP security note 2147745, "Potential modification of persisted data in SAP CPQ Solution Configuration (SME)", is released on 31.03.2015. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can exploit SAP CPQ Solution Configuration by using specially crafted inputs to modify database commands, leading to the alteration of data persisted by the system.

Solution

To address this vulnerability, implement the automatic correction instructions which involve creating a specific authorization role and assigning it to all modelers exporting configuration knowledge bases from the solution modeling environment into ECC.

Creating the authorization role /SLCE/SME:

• Start transaction PFCG.
• Enter role name /SLCE/SME.
• Click on Edit.
• Navigate to the Authorizations tab.
• Select Change Authorization Data.
• Choose Manually for "Manual entry of authorization objects".
• In the popup, enter S_TABU_NAM and confirm.
• Expand the hierarchy to find "Activity" and "Table Name".
• Set Activity to Display.
• Save and transfer.
• Modify the Table Name to include COMM_CFG* and /1SAP1/*.
• Save and transfer, then save the role.
• Generate the default profile.

For detailed steps, refer to SAP Security Note 2147745.

Reason and prerequisites

This vulnerability arises from an SQL injection flaw in the code that constructs SQL statements with user-manipulable strings. An attacker can manipulate these statements to modify database information.