Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Code injection vulnerability in EHS-MGM-FND, SAP security note 2187594

SAP Note 2187594
SAP Security Note
Medium priority

SAP security note 2187594, "Code Injection Vulnerability in EHS-MGM-FND", is a program error note released on 26.04.2018. Below are the symptom, SAP recommended solution and the affected software components.

ComponentEnvironment, Health, and Safety / Product Compliance > SAP EHS Management > Foundation for EHS Management
CategoryProgram Error
PriorityCorrection with medium priority
TypeSAP Security Note
StatusReleased for Customer
Released on26.04.2018

Description

Symptom

EHS-MGM-FND contains code that permits the execution of arbitrary program code chosen by the user. An attacker can control the behavior of the system or potentially escalate privileges by executing malicious code without having legitimate credentials.

Solution

Implement the correction instructions provided in the SAP Security Note.

Reason and prerequisites

The program code allows the definition and execution of user-defined code that changes the system’s behavior. A valid and authenticated user is required.

Depending on the code, the user can:

  • Inject and run their own code
  • Obtain additional information that should not be displayed
  • Modify data, delete data
  • Modify the output of the system
  • Create new users with higher privileges
  • Perform a denial of service attack

CVSS

Score 0

Affected components

  • EHSM (600)

Full note on SAP: SAP Support Launchpad note 2187594

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Injection #Run #Credentials #EHS-MGM-FND #Malicious Code #Modify Data

Explore More