Code injection vulnerability in condition technique, SAP security note 1508412

SAP security note 1508412, “Code Injection Vulnerability in Condition Technique”. Below are the symptom and the SAP recommended solution.

Description

Symptom

Condition technique contains code that allows the execution of arbitrary program code of the user’s choice. A malicious user can control the system’s behavior or escalate privileges by executing malicious code without legitimate credentials.

Solution

Apply the attached correction instructions provided in the SAP Security Note. Ensure that Manual Preimplementation Steps are also performed as outlined in the instructions.

Reason and prerequisites

The program code allows defining and executing user-supplied code, altering system behavior. No valid or authenticated user is required. Depending on the injected code, attackers can:

• Inject and run their own code
• Obtain unauthorized information
• Modify or delete data
• Alter system output
• Create users with higher privileges
• Perform denial of service attacks

References

Ensure the following SAP Notes are applied before implementing this security note:

• SAP Note 1116565 – Runtime After Import Method /SAPCND/TRN_AFTER_IMPORT_OW
• SAP Note 1139316 – Generation on the fly for test applications of condition technique
• SAP Note 1179438 – XPRAS_UPG: run time error DBIF_RSQL_INVALID_RSQL
• SAP Note 1180126 – Online generation and mass activation