SAP security note 2274560, "Arbitrary Log File Injection Vulnerability in SAP Gateway", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Gateway allows an attacker to inject character sequences into the log file. As a result, administrators may analyze incorrect content in log files, leading to potential misinterpretations and oversight of malicious activities.
A malicious user can inject arbitrary character sequences by manipulating the TP name in SAP Gateway’s log files. This injection can confuse users analyzing the logs, potentially masking malicious activities or leading to incorrect assessments.
Solution
Apply the patch mentioned in this SAP Note to validate character sequences for TP names. The correction ensures that any character sequence containing non-contributory characters to a TP name is rejected. After applying the patch, log entries will indicate invalid TP names as follows:
S Tue Jan 12 2016 10:55:18:791 REGISTER_TP invalid tpname (tp#name_newline) from [127.0.0.1]
CVSS
Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2274560
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
