Code Injection vulnerability in TREX / BWA, SAP security note 2419592

SAP security note 2419592, "Code Injection vulnerability in TREX / BWA". Below are the symptom and SAP recommended solution.

Description

Symptom

TREX/BWA allows an attacker to inject code that can be executed by the application, thereby controlling the application’s behavior.

Some well-known impacts of Code Injection vulnerability are:

• Unauthorized execution of commands
• Sensitive information disclosure
• Denial of Service

Solution

Upgrade to the following versions:

• TREX 7.10 revision 74 or higher
• BWA 7.00 revision 76 or higher
• BWA 7.20 revision 40 or higher
• TREX 7.25 revision 37 or higher

These revisions include an access control that prevents processes running on a machine not belonging to the current TREX/BWA landscape from using commands from the internal interface. No further action is needed beyond upgrading to the respective revision.

Reason and prerequisites

There is an internal interface to TREX/BWA which allows executing commands (some are OS-related) using SIDadm rights on the host machines. The interface is required for running TREX/BWA and provides no authentication.

Implementing this Security Note prevents host OS compromise and potential technical information disclosure from outside of the TREX/BWA subnet. Even if the TREX/BWA landscape is not running in an isolated subnet, the internal interface cannot be used if the machine is not part of the TREX/BWA landscape.

CVSS

Score 9.4 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L