Code injection vulnerability in ABAP Dictionary, SAP security note 1738988

SAP security note 1738988, "Code injection vulnerability in ABAP Dictionary", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Security Note 1738988 addresses a critical code injection vulnerability in the ABAP Dictionary. This vulnerability allows authenticated users with developer and ABAP Dictionary rights to execute arbitrary code, potentially escalating privileges or disrupting system operations.

The ABAP Dictionary contains functionality that permits users to create and execute arbitrary program code. An attacker with the necessary permissions can manipulate system behavior or escalate privileges by running malicious code without legitimate credentials.

Solution

To mitigate this vulnerability:

• Install the Latest Support Package: Ensure your system is updated with at least the highest-level support package referenced in this security note.
• Implement Correction Instructions: Apply the correction instructions provided, which restrict the functionality of the RADGENREP report and prevent runtime errors in the DB_DATA_MOVE function module.

Reason and prerequisites

The vulnerability exists because the program code allows the definition and execution of user-defined code that alters system behavior. To exploit this vulnerability, an attacker must:

• Be a valid and authenticated user with developer and ABAP Dictionary rights.
• Utilize the report RADGENREP to inject and execute malicious code.

Potential impacts include:

• Injecting and running arbitrary code.
• Accessing confidential information.
• Modifying or deleting data.
• Altering system output.
• Creating users with elevated privileges.
• Executing denial of service attacks.

CVSS

Score 8.2 Vector: AV:N/AC:M/AU:S/C:P/I:C/A:C

Affected components

• SAP_BASIS 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730
• SAP_BASIS 731
• SAP_BASIS 740