Description
Symptom
If SAP Commerce is configured to use an Oracle database and if a query is created using the flexible search java api with a parametrized “in” clause SAP Commerce allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parametrized “in” clause accepts more than 1000 values.
The problem can affect any kind of extension using the flexible search api with an “in” clause with partially untrusted input and potentially some internal components of the platform when using an Oracle database.
Other Terms
Injection attack, blind SQL injection, database vulnerabilities, CVE-2021-42064
Reason and Prerequisites
Any SAP Commerce installation using Oracle database is impacted.
Solution
SAP Commerce addresses this vulnerability by properly escaping any value passed to parametrized “in” clause when handling flexible search queries having more than 1000 values used in this clause.
The following patch releases address this vulnerability:
- SAP Commerce Cloud Patch Release 2105.2
- SAP Commerce Cloud Patch Release 2011.12
- SAP Commerce Cloud Patch Release 2005.17
- SAP Commerce Cloud Patch Release 1905.33
The Software Downloads of these or later patches are available in the SAP Support Portal. For information about installing patches, see About Patch Releases.
Available fix and Supported packages
Affected component
HY_COM
CVSS
Score:8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploit
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/3114134
