High priority
SAP security note 1688518, “Code Injection Vulnerability in Module Editor”, is a program error note released on May 8, 2012. Below are the symptom and SAP recommended solution.
Description
Symptom
In the customization of the Module Editor, arbitrary ABAP code can be entered. An attacker can control system behavior or escalate privileges by executing malicious code without having legitimate credentials.
An attacker with the necessary developer authorization (S_DEVELOP object) can:
- Inject and execute their own code.
- Access sensitive information that should remain hidden.
- Modify or delete data.
- Alter the system’s output.
- Create new users with elevated privileges.
- Perform denial-of-service attacks.
Solution
Implement the attached corrections or the corresponding support packages to mitigate this vulnerability. After applying this note, users without developer authorization will be restricted to using predefined commands in the Module Editor, preventing the injection of multiple sentences unless they possess the required authorization.
References
This note refers to
- 1688294 – New step types for SDL Primary Objects
- 1675511 – Code injection vulnerability in module editor for BA70-80
- 967155 – Generation of Modules is not performed after transport
- 1001391 – Module cannot be deleted because of incorrect WUL
- 1349191 – Module Editor: Where-Used List ignores comment steps
- 1367232 – Lines in print-preview are cut off
- 1371825 – Continue of note 1367232
- 1554575 – Wrong order of exceptions in FM step
- 1356259 – WUL doesn’t work for DDIC environment
Full note on SAP: SAP Support Launchpad note 1688518
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].