[CVE-2021-42064] SQL Injection vulnerability in SAP Commerce, SAP security note 3114134

SAP security note 3114134, "[CVE-2021-42064] SQL Injection vulnerability in SAP Commerce". Below are the symptom and SAP recommended solution.

Description

Symptom

A SQL Injection vulnerability (CVE-2021-42064) exists in SAP Commerce when it is configured to use an Oracle database. Specifically, if a query is created using the flexible search Java API with a parameterized "in" clause that accepts more than 1000 values, an attacker can execute crafted database queries, potentially exposing the backend database. The issue can affect any extension using the flexible search API with an "in" clause containing partially untrusted input, as well as some internal components of the platform when using an Oracle database.

This vulnerability allows for injection attacks, including blind SQL injection, which can lead to unauthorized access to confidential data, integrity manipulation, and availability disruption of the affected system.

Solution

SAP Commerce addresses this vulnerability by properly escaping any value passed to parameterized "in" clauses when handling flexible search queries with more than 1000 values.

The following patch releases address this vulnerability:

• SAP Commerce Cloud Patch Release 2105.2
• SAP Commerce Cloud Patch Release 2011.12
• SAP Commerce Cloud Patch Release 2005.17
• SAP Commerce Cloud Patch Release 1905.33

Software downloads for these or later patches are available in the SAP Support Portal. For information about installing patches, see About Patch Releases.

Reason and prerequisites

Any SAP Commerce installation using an Oracle database is impacted.

CVSS

Score 8.8 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• CVE-2021-42064