BRF+ Syntax error and code injection vulnerability, SAP security note 1584602

SAP security note 1584602, "BRF+: Syntax error and code injection vulnerability", is a note released on January 10, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses a syntax error and code injection vulnerability in BRF+ (ABAP based Rule Framework). If a user includes the character "`" in the email body or message text, it can cause generation failures with a syntax error. Additionally, the mishandling of this character allows a malicious user to execute arbitrary code. This vulnerability can enable unauthorized control over system behavior or privilege escalation through malicious code execution.

Solution

Implement the corrections specified in this note to address the vulnerabilities. Ensure that you apply the relevant support packages:

• SAPKB70110 for SAP_BASIS 701
• SAPKB70209 for SAP_BASIS 702
• SAPKB73004 for SAP_BASIS 730

References

• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• Basis Services/Communication Interfaces > BRFplus – ABAP based Rule Framework (BC-SRV-BR)
• SAP_BASIS 701 to 702
• SAP_BASIS 730