SAP security note 2973735, "[CVE-2020-26808] Code Injection in SAP AS ABAP and S/4 HANA (DMIS)". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
UPDATE 17th November 2020: This note has been re-released with updated "Support Packages & Patches" information. For the release S4CORE 104, we added the support package SP00.
SAP AS ABAP and SAP S/4 HANA allows an authenticated attacker to inject arbitrary code in the application and change the course of execution. Due to lack of input validation, an attacker who has been granted access (S_RFC) to execute the function module can inject malicious ABAP code, which will be saved persistently in a report in the ABAP repository.
This report can then be executed by using the remote function module without additional authorization checks. The successful exploitation of the identified vulnerability can allow the attacker to take complete control of the affected system.
Solution
The affected function module is used for checking the syntax for a table selection query. The solution for the issue is to introduce an authorization check (object S_DMIS, level ‘Package’, and activity value ’01’ – create and generate) in the affected function module, and to remove/delete the generated coding from the ABAP repository. The generated report still exists but without any coding, thereby removing the possibility to exploit the identified vulnerability.
In systems where the affected function module is not used, the complete coding of the function module is commented out.
Actions to take:
- Implement the correction note 2973735 or
- Upgrade to the corresponding Support Packages referenced by this SAP Security Note.
CVSS
Score 9.1 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
Affected components
- DMIS (2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2018_1_752, 2020)
- S4CORE (100, 101, 102, 103, 104, 105)
Full note on SAP: SAP Support Launchpad note 2973735
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].