SAP security note 2620738, "[CVE-2018-2427] Code Injection vulnerability in SAP CrystalReports". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
CrystalReportsViewer allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Some well-known impacts of Code Injection vulnerability are:
- Unauthorized execution of commands
- Sensitive information disclosure
- Denial of Service
Solution
The vulnerable function eval() has been replaced with a safe one that performs the same functionalities.
Reason and prerequisites
The reason is that the old function accepts any code. The prerequisite is that the user needs to be logged on to the system.
CVSS
Score 6.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
Full note on SAP: SAP Support Launchpad note 2620738
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].