SAP security note 2983367, "[CVE-2020-26838] Code Injection vulnerability in SAP Business Warehouse (Master Data Management) and SAP BW4HANA", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
UPDATE 12th January 2021: This note has been re-released with updated ‘validity’, and ‘Support Packages & Patches’ information. We enhanced the validity for all covered codelines to the lowest possible SP-level.
SAP BW Master Data Management and SAP BW4HANA allows an attacker with high privileges ability to submit a crafted request to generate and execute code without requiring any user interaction. These malicious requests could result in the execution of operating system commands that may completely compromise the confidentiality, integrity, and availability of the server and any data or other applications running on it.
Solution
To resolve the issue, please implement the attached correction instruction or the equivalent support package:
- For release 7.30, the affected function module has been equipped with a hard-coded report name which is used by the only legitimated caller.
- Starting with release 7.40 in SAP BW/4HANA, the function should not be used anymore and thus has been disabled, meaning the code was removed.
Reason and prerequisites
Misuse of a delivered function with the intention to execute arbitrary reports in the system
CVSS
Score 9.1 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Full note on SAP: SAP Support Launchpad note 2983367
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].