Low priority
SAP security note 2426260, "SQL Injection Vulnerability in SAP HANA Extended Application Services", is a program error note released on 14.03.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The user profile management feature permits authenticated users to modify their profiles. Due to missing input validation, an attacker can inject SQL commands to update the calling user’s profile. These SQL commands are executed with the privileges of the calling user, although privilege escalation is not possible.
Solution
The vulnerability has been fixed in the following revisions:
- SAP HANA 1.00 SPS 12: Revision 122.07
- SAP HANA 2.0 SPS 00: Revision 001
Update your SAP HANA systems to these or later versions. Workaround: revoke the role sap.hana.xs.formLogin::ProfileOwner from users; this will prevent users from setting user profile parameters directly, and instead user profile parameters can be set using the SQL console.
Reason and prerequisites
The vulnerability exists because the user profile management lacks proper input validation, allowing SQL command injection. The precondition for exploitation is that the role sap.hana.xs.formLogin::ProfileOwner has been granted to the user.
CVSS
Score 2.7/10 Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected components
- HDB 1.00
- HDB 2.00
Full note on SAP: SAP Support Launchpad note 2426260
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].