Potential modif./disclosure of persisted data in SAP Batch Processing, SAP security note 2193389

SAP security note 2193389, "Potential modification/disclosure of persisted data in SAP Batch Processing", is a program error note released on 08.10.2015. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can exploit SAP Batch Processing and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

Implement the provided correction to secure the dynamic SQL implementation in the BP_FIND_JOBS_WITH_PROGRAM function. Apply the relevant Support Package as mentioned in this SAP Note or follow the respective correction instructions.

Reason and prerequisites

The issue is caused by an SQL injection vulnerability in the function BP_FIND_JOBS_WITH_PROGRAM. The code constructs an SQL statement containing strings that can be altered by an attacker, allowing manipulation to retrieve or modify database data.

CVSS

Score 4.6 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P

References

• SAP Note 1502272 – Function module for escaping quotes
• SAP Note 1487337 – Downporting the class CL_ABAP_DYN_PRG
• SAP Note 1850709 – Access to unsorted data by programs of SAP_BASIS
• SAP Note 2107411 – Improved error messages for job API