SAP security note 1953562, “Code injection vulnerability in Card Management”, is a program error note released on 12.08.2014. Below is the security information published by SAP for this note.
Description
Symptom
Card Management contains code that permits the execution of arbitrary program code of the user's choice. An attacker can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.
Reason and prerequisites
The program code allows the definition and execution of user-defined code that changes the system's behavior. A valid and authenticated user is required. Depending on the code, the user can:
- Inject and run their own code
- Obtain additional information that should not be displayed
- Modify data, delete data
- Modify the system's output
- Create new users with higher privileges
- Perform a denial of service attack
Solution
Import the relevant Support Package for your release. Use transaction SNOTE to implement the attached correction instructions in advance. No manual tasks are required.
Affected components
- FSAPPL versions 100, 200, 300, 400
- BANK-TRBK version 40
Full note on SAP: SAP Support Launchpad note 1953562
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
