SAP security note 2545530, "Preventing CSV Export Vulnerabilities in SAP BW". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
In Web Dynpro-based InfoObject master data maintenance and hierarchy maintenance, the option to download table data as a CSV file is available. However, if the table contains values that can be interpreted as commands in Microsoft Excel, these commands may execute automatically when the file is opened in Excel, posing a security risk.
Solution
To mitigate this vulnerability, you should implement SAP Note 2545530 or import the appropriate support packages for your SAP BW version:
- SAP BW 7.50: import Support Package 11 for SAP BW 7.50 (SAPK-75011INSAPBW) after installing SAP Note 2544313.
- SAP BW 7.51: import Support Package 6 for SAP BW 7.51 (SAPK-75106INSAPBW) after installing SAP Note 2544283.
- SAP BW 7.52: import Support Package 1 for SAP BW 7.52 (SAPK-75201INSAPBW) after installing SAP Note 2487153.
- SAP BW/4HANA 1.0: import Support Package 7 for SAP BW/4HANA 1.0 (SAPK-10007INDW4CORE) after installing SAP Note 2526413.
Affected components
- SAP BW 7.50
- SAP BW 7.51
- SAP BW 7.52
- SAP BW/4HANA 1.0
Full note on SAP: SAP Support Launchpad note 2545530
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].