SAP security note 1560334, "Potential disclosure of persisted data in database". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the database and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.
Solution
The ABAP reports
- RSORA100
- RSORA820
- RSORACMP
- RSORAOPS
- RSORAINI
- RSORATB1
- RSORATB2
- RSORATB3
- RSORATC2
- RSORATC6
- RSORATC8
- RSORADJV
are deleted with SAP Note 1523173 starting with SAP Basis Release 7.00.
For SAP systems with an older Basis Release, the roles which pass the authority object S_ADMI_FCD need to be carefully assigned to users.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.
The report RSORADJV allows running SQL queries on Oracle performance views. It accepts only read accesses to the database and no data manipulation. However, by chance, it might be possible to read application data.
The remaining reports (see list of reports below) are part of the monitoring transactions ST04 and DB02. If run alone, these reports provide structural information (like size, number of table lines, etc.) of database objects.
Affected components
- SAP_BASIS: 46C, 620, 640, 700, 702, 710, 730
Full note on SAP: SAP Support Launchpad note 1560334
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
