SAP security note 2941667, "[CVE-2020-6296] Code Injection Vulnerability in SAP NetWeaver (ABAP) and ABAP Platform". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
UPDATE 22nd September 2020: This note has been re-released with the updated automatic correction instruction for NW Release 750 to additionally cover SP00 to SP05.
UPDATE 8th September 2020: This note has been re-released with the updated 'Correction instruction' information. The correction instructions for releases NW 700 and 701 have been adjusted with an additional dependency to SAP Note 1497003.
SAP NetWeaver (ABAP Server) and ABAP Platform allow a low-privileged attacker to inject code by executing an ABAP report over the network. An attacker could gain access to data, overwrite arbitrary SAP programs including essential logon programs, and potentially lead to a Denial of Service.
Solution
This SAP Note implements the following corrections:
- Moves the authorization check S_BDC_MONI from SHDB to RSBDCREC.
- Prevents malicious code injection by changing the INSERT REPORT behavior using the central API to create development objects.
Authorization checks are performed against authorization S_BDC_MONI with parameters 'BDCAKTI' (values 'RSCP' and 'ORCS') and 'BDCGROUPID' (customer-defined token).
Code creation has been changed from a local implementation to a central API. Besides various repository checks, the API requires that the user has authorization S_DEVELOP with parameters 'OBJTYPE' (dynamic), 'OBJNAME' (dynamic), and ACTVT (based on developer role).
Reason and prerequisites
The batch input recorder report RSBDCREC is executable without an appropriate authorization check for any authenticated user if executed directly outside the context of transaction SHDB. The recorder enables the user to perform various code injections, which might be stored in either a recording or an extension in the DSN parameter.
CVSS
Score 8.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Affected components
- SAP_BASIS 700 to 755
Full note on SAP: SAP Support Launchpad note 2941667
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].