SAP security note 3123196, "[CVE-2021-44235] Code Injection Vulnerability in SAP NetWeaver AS ABAP". Below are the symptom and SAP recommended solution.
Description
Symptom
UPDATE 11th January 2022: this note has been re-released with updated ‘Reason and Prerequisites’ information. We have made some textual changes regarding validity.
A code injection vulnerability exists in a utility class of SAP NetWeaver AS ABAP. An attacker with high privileges and direct access to the SAP system can inject code via transaction SE24 – Class Builder. This can lead to the execution of arbitrary commands on the operating system, significantly impacting the Confidentiality, Integrity, and Availability of the system.
Solution
Option 1: No action needed if the user does not have permission to execute development objects through transactions SE24/SE80.
Option 2: Implement the note using SNOTE to remove the vulnerable coding. The Post-Copy Automation (PCA) functionality has been integrated into SAP Basis for older releases/SPS, and some dependent notes must also be implemented.
Reason and prerequisites
The following releases of the SAP_BASIS component are affected:
- 7.00 SP32-SP39
- 7.01 SP17-SP24
- 7.10 SP22-SP25
- 7.11 SP17-SP20
- 7.02 SP17-SP24
- 7.30 SP13-SP21
- 7.31 SP15-SP30
- 7.40 SP10-SP27
- 7.50 SP00-SP22
- 7.51 SP00-SP13
- 7.52 SP00-SP09
- 7.53 SP00-SP07
- 7.54 SP00-SP05
- 7.55 SP00-SP03
- 7.56 SP00-SP01
(*) Applies if using license-bound product Post-Copy Automation (PCA). Check with transaction SAINT for add-on PCAI_ENT.
Users must have permissions to use SE24/SE80 and execute development objects (authorization object S_DEVELOP with fields OBJTYPE = CLAS and ACTVT = 16 ‘Execute’).
The compromised utility class is exclusively used for the license-bound SAP tool Post-Copy Automation (PCA) and does not affect standard functionality.
CVSS
Score 8.4 Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Full note on SAP: SAP Support Launchpad note 3123196
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
