OS injection through call of function module by SM37, SAP security note 2197100

SAP security note 2197100, “OS injection through call of function module by SM37”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A security vulnerability has been identified that allows OS injection through the call of the function module SCTC_REFRESH_EXPORT_USR_CLNT using transaction SM37.

Solution

If you do not have the PCAI_ENT add-on installed:

1. Apply the Latest Support Package for your release (SAP_BASIS 7.00 SP32, 7.01 SP17, 7.02 SP17, 7.10 SP20, 7.11 SP15, 7.30 SP13, 7.31 SP15, or 7.40 SP10).

2. Modify the Function Module SCTC_REFRESH_EXPORT_USR_CLNT:

• Go to transaction SE37.
• Change the function module SCTC_REFRESH_EXPORT_USR_CLNT.
• Mark all code except the first and last lines as comments.
• Ensure the first and last lines are not commented out.
• Activate the function module.

3. Enforce Security Rules to Mitigate Risks:

• Control access to transaction SE37 using authorization object S_DEVELOP, type FUGR, and activity 16 (execute).
• Control access to transaction SE24 using authorization object S_DEVELOP, type CLAS, and activity 16 (execute).
• Control access to authorization objects S_C_FUNCT and S_DATASET.

If you have the PCAI_ENT add-on installed, apply the latest Support Package and implement SAP Note 2039075 System Copy: Task Content (8. Improvements), which disables the function module SCTC_REFRESH_EXPORT_USR_CLNT when called via transaction SE37.

For more details, visit the SAP Security Notes page. Always conduct a risk assessment based on your system configuration and operational environment before applying security notes.

CVSS

Score 7.1 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C

Affected components

• Release 7.00 SAP_BASIS SP22 – SP31
• Release 7.01 SAP_BASIS SP07 – SP16
• Release 7.02 SAP_BASIS SP05 – SP16
• Release 7.10 SAP_BASIS SP11 – SP18
• Release 7.11 SAP_BASIS SP06 – SP13
• Release 7.30 SAP_BASIS SP00 – SP12
• Release 7.31 SAP_BASIS SP00 – SP14
• Release 7.40 SAP_BASIS SP00 – SP09