Audit Trail Potential disclosure of persisted data, SAP security note 1578054

SAP security note 1578054, “Audit Trail: Potential disclosure of persisted data”. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit transaction S_AUT10 by using specially crafted inputs to modify database commands. This can lead to the retrieval of additional information persisted by the system.

Solution

To mitigate this vulnerability, you should import the relevant Support Package associated with this note. Additionally, the Support Package includes performance improvements for evaluating the audit trail (transaction S_AUT10). For more information, refer to SAP Note 1641928.

Reason and prerequisites

The issue arises from an SQL injection vulnerability where the code constructs an SQL statement with user-alterable strings. This manipulated SQL statement can be used to access sensitive data from the database. The prerequisite for exploitation involves analyzing table logs for database tables with non-character-type key fields, which are rarely used in the standard SAP system.

References

• SAP Note 1641928 – Transaction S_AUT10: Performance for packaged reading
• SAP Note 1460757 – S_AUT10: Database selection leads to short dump