SAP Security Note
High priority
SAP security note 1612690, "Code injection vulnerability in WD ABAP ALV", is a note released on 11.10.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
WD ABAP ALV contains code that permits the execution of arbitrary program code of the user’s choice.
A malicious user can control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.
Solution
Apply this note.
Reason and prerequisites
The program code allows defining and executing user-defined code that changes the system behavior. A valid and authenticated user is required, with authorization for ALV Trace.
Depending on the code, the user can:
- Inject and run their own code
- Obtain additional information that should not be displayed
- Modify data, delete data
- Modify the output of the system
- Create new users with higher privileges
- Perform a denial of service attack
Full note on SAP: SAP Support Launchpad note 1612690
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
