Code Injection vulnerability in Text Conversion, SAP security note 2371726

SAP security note 2371726, "Code Injection Vulnerability in Text Conversion". Below are the symptom and SAP recommended solution.

Description

Symptom

UPDATE 13 October 2017: This note has been re-released with updated ‘Correction Instructions’ information.

Text Conversion, which enables SAP standard text to be replaced by industry-specific text, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Some well-known impacts of Code Injection vulnerability are:

• Unauthorized execution of commands
• Sensitive information disclosure
• Denial of Service

Solution

The solution restricts the name of the directory to be created to a real name, allowing only "_" as a special character.

Please apply the Support Package mentioned in this SAP Note, or the respective correction instruction.

Reason and prerequisites

Function BRAN_DIR_CREATE enables an authenticated development user to inject operating system commands and execute these from the SAP system via that function. Developer rights (S_DEVELOP) are required.

CVSS

Score 9.1 / 10 Vector: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

• Potential Modification of Persisted Data in IS-R-STR