SAP security note 1592312, "Code injection vulnerability in EC-EIS". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
RKC_FUNCTION_INTERFACE_GEN contains code that permits the execution of arbitrary program code of the user’s choice. A malicious user can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.
Solution
Implement the attached corrections provided in this security note.
Reason and prerequisites
The program code allows the definition and execution of user-defined code that changes the system’s behavior. A valid and authenticated user with authorization to call an RFC module is required. Depending on the code, the user can:
- Inject and run their own code
- Obtain additional information that should not be displayed
- Modify or delete data
- Modify the system’s output
- Create new users with higher privileges
- Perform a denial of service attack
CVSS
Score 3.5 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
References
Affected components
- SAP_APPL 31I
- SAP_APPL 40B
- SAP_APPL 45B
- SAP_ABA 46C
- SAP_ABA 620
- SAP_ABA 640
- SAP_ABA 700-702
- SAP_ABA 710-730
- SAP_ABA 731
Full note on SAP: SAP Support Launchpad note 1592312
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
