SAP security note 2491763, “SQL Injection vulnerability in GRC Access Controls”, is a note released on 16.08.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An SQL Injection vulnerability exists in the Mitigation process of GRC Access Control, allowing attackers to execute crafted database queries and potentially expose the backend database. This can lead to:
- Unauthorized reading, modification, or deletion of sensitive data.
- Execution of administrative-level operations on the database.
Solution
1. Input Validation: The Mitigation process now screens user inputs to ensure proper data submission and removes potentially dangerous SQL statements.
2. Implement Corrections: Follow the provided correction instructions to address the vulnerability.
Reason and prerequisites
The vulnerability arises due to the use of dynamic conditions for querying the database in the Mitigation process within Access Controls.
References
- Master Note for SAP Access Control 10.1 – Support Pack 19
- Master Note for SAP Access Control 10.0 – Support Pack 26
Affected components
- GRCFND_A V1000
- GRCFND_A V1100+
- GRCFND_A V8000
Full note on SAP: SAP Support Launchpad note 2491763
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
