Code injection vulnerability in BW-EI-APD, SAP security note 2162829

SAP security note 2162829, "Code injection vulnerability in BW-EI-APD". Below are the symptom and SAP recommended solution.

Description

Symptom

Analysis Process Designer (BW-EI-APD) allows users to include arbitrary program code in an analysis process object. This code is executed when the analysis process starts, enabling an attacker to control system behavior or potentially escalate privileges by executing malicious code.

Solution

Restrict authorization:

• Review and manage users authorized to maintain ABAP routines in analysis processes (authorization object RSANPR, activity 36).
• Ensure only users with developer roles have this authorization or remove the ability to create code in APD for unauthorized users.

Depending on your SAP BW version, apply the relevant Support Package as detailed below:

• SAP Business Warehouse (SAP BW) 7.0: Import Support Package 35 for SAP BW 7.00 (SAPKW70035). Available via SAP Note 2009937.
• SAP BW 7.01 (SAP BW 7.0 EHP 1): Import Support Package 18 for SAP BW 7.01 (SAPKW70118). Available via SAP Note 2123573.
• SAP BW 7.02 (SAP BW 7.0 EHP 2): Import Support Package 18 for SAP BW 7.02 (SAPKW70218). Available via SAP Note 2126275.
• SAP BW 7.11: Import Support Package 15 for SAP BW 7.11 (SAPKW71115). Available via SAP Note 2083158.
• SAP BW 7.30: Import Support Package 14 for SAP BW 7.30 (SAPKW73014). Available via SAP Note 2132939.
• SAP BW 7.31 (SAP BW 7.3 EHP 1): Import Support Package 17 for SAP BW 7.31 (SAPKW73117). Available via SAP Note 2139356.
• SAP BW 7.40: Import Support Package 12 for SAP BW 7.40 (SAPKW74012). Available via SAP Note 2143705.

Reason and prerequisites

The vulnerability exists because the program code in BW-EI-APD allows the definition and execution of user-defined code that alters system behavior. To exploit this vulnerability, an attacker must have authorization for the authorization object RSANPR with activity 36 (enhanced maintenance) to insert ABAP routines into an analysis process, and authorization to maintain the analysis process, which depends on the system change option (modifiability of repository objects).

Potential impacts:

• Inject and execute arbitrary code.
• Obtain unauthorized information.
• Modify or delete data.
• Alter system output.
• Create users with elevated privileges.
• Perform denial of service attacks.

CVSS

Score 4.6 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P