SAP security note 1454952, "Code Injection vulnerability in Role synchronization report.", is a note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Role Synchronization report contains code which allows the execution of arbitrary program code, such as an RFC destination of the user’s choice. A malicious user can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without legitimate credentials.
Solution
Import the attached advanced correction or import the relevant support package to temporarily disable the affected function.
Reason and prerequisites
The program code includes the ability to define and execute code of the user’s choice, altering the system’s behavior. A valid and authenticated user is required to create or modify roles in the system. Depending on the code, the user can inject an RFC destination of their choice and run their own code, which may create, modify, or corrupt roles in the selected system, posing a threat by altering the system’s output.
Affected components
- SAP SRM 7.01
- SAP SRM 7.0
Full note on SAP: SAP Support Launchpad note 1454952
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].