SAP security note 2719530, "[CVE-2019-0304] Code Injection vulnerability in SAP NetWeaver AS ABAP Platform (FTP Function)", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The FTP Function of SAP NetWeaver AS ABAP Platform allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Impacts of Code Injection vulnerability include:
- Unauthorized execution of commands
- Sensitive information disclosure
- Denial of Service
Solution
SAPFTP program will check if the FTP command contains CR or LF. If yes, the part of the command after CR or LF will be removed. To get the fix, apply the corresponding patch.
Reason and prerequisites
The issue occurs only if the attacker has the authorization to modify the ABAP code calling functions FTP_COMMAND or FTP_COMMAND_LIST.
CVSS
Score 5.5 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
References
Affected components
- KRNL32NUC, KRNL32UC, KRNL64NUC, KRNL64UC, KERNEL: versions 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73
Full note on SAP: SAP Support Launchpad note 2719530
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].