SAP security note 1470350, "Code Injection Vulnerability/Missing Auth-Check in SRM", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The Supplier Relationship Management (SRM) solution contains code that allows the execution of arbitrary program code of the user's choice. A malicious user can control the system's behavior or potentially escalate privileges by executing malicious code without legitimate credentials.
An authenticated user can access functionalities in SRM that should be restricted, potentially resulting in privilege escalation.
Solution
Implement the correction instructions manually or apply the necessary support package. You can download the required support packages here or view the PDF version here.
Reason and prerequisites
The program code allows users to define and execute arbitrary code, altering the system's behavior. Depending on the injected code, users can obtain unauthorized information, modify or delete data, alter system output, create users with higher privileges, or perform denial of service attacks.
Additionally, the application lacks proper permission checks for certain functionalities, leading to undesired system behavior.
References
This note refers to
Affected components
- SRM_SERVER: Versions 550, 600, 700, 701
- SRM_EXT: Versions 700, 701
Full note on SAP: SAP Support Launchpad note 1470350
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].