Code injection vulnerability in ABAP Verification, SAP security note 1827217

SAP security note 1827217, “Code Injection Vulnerability in ABAP Verification”, is a program error note released on 09.04.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

ABAP Verification contains code that permits the execution of arbitrary commands of the operating system of the user’s choice. This allows an attacker to control system behavior or potentially escalate privileges by executing malicious code without legitimate credentials.

Solution

Apply the support packages mentioned in this note to delete program RSXBNFCH. Additionally, follow the correction instructions to make RSXBNFCH unusable, thereby disabling command execution.

Reason and prerequisites

The program code allows defining and executing user-defined commands on the OS level, altering system behavior. A valid authenticated user is required.

CVSS

Score 8.5 Vector: AV:N/AC:M/AU:S/C:C/I:C/A:C

References

• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)