SAP security note 1496919, "Executing any source code and unauthorized change…". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
- A malicious user may be able to execute any source code.
- A malicious user could modify displayed application content without authorization, save the modified data, and potentially obtain authentication information from other legitimate users.
Solution
The affected parts of the source code have been completely retired by inserting ASSERT statements and commenting out problematic sections to eliminate the risk of an attack. This includes removing the experimental Business Server Page used in the Business Rule Framework.
Reason and prerequisites
The program code allows defining and executing user-supplied code, altering system behavior. Valid logon information is required, but the source code items are not accessible in the standard SAP system as they are experimental.
A Business Server Page within the Business Rule Framework does not sufficiently encode input parameters, resulting in a permanent cross-site scripting (XSS) vulnerability. This allows malicious users to store and execute scripts, potentially compromising user data and system security.
CVSS
Score 0
References
- SAP Note 857791 – Implementing code generation for the BRF
- SAP Note 939740 – Continuation of code generation
Affected components
- SAP_BASIS: 710 to 730
- SAP_ABA: 640 to 702
- ABA_PLUS: 100
Full note on SAP: SAP Support Launchpad note 1496919
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].