SAP security note 1578645, "BRF+: Problems with special characters in generated coding", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
- Using characters ` or ‘ in BRFplus decision tables or formulas results in syntax errors during code generation.
- Potential for code injection by malicious users if user-defined code is allowed without proper sanitization.
Solution
To resolve these issues, apply the correction instructions provided in this security note. Ensure that your system is updated with the necessary support packages.
Reason and prerequisites
When assigning values in the format Text = ‘Peter O’Toole’s Hotel’, the apostrophe (‘) in the string prematurely terminates the string, causing syntax errors. The system needs to differentiate between string delimiters and apostrophes within the string, requiring proper escaping (e.g., replacing ‘ with ”). Additionally, unauthenticated or improperly restricted user-defined code execution can enable malicious activities such as code injection, data manipulation, or denial of service attacks.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1578645
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
