SAP security note 1392974, "Logging Configuration Changes via Exchange Profile". Below are the symptom and the SAP recommended solution.
Description
Symptom
Changes to AIIProperties in the NW PI Exchange Profile application are not being logged, which can lead to untracked modifications and potential security vulnerabilities.
Solution
The provided patch ensures that all modifications to AIIProperties are logged under specific system categories based on the SAP NetWeaver PI release:
- SAP NetWeaver PI 7.2 and SAP EHP1 for SAP PI NetWeaver 7.2 onwards: Logged under "/System/Changes/Properties".
- SAP NetWeaver PI 7.1 and SAP EHP1 for SAP PI NetWeaver 7.1: Logged under "/System/Changes" with the constant SYS_CHANGES.
Reason and prerequisites
For enhanced security and auditing, it’s essential that all changes to AIIProperties (Application Integration Infrastructure) are logged. This ensures that any modifications made via the Exchange Profile are tracked appropriately.
References
- SAP Note 1576121
- SAP Note 1570040
- SAP Note 1564466
- SAP Note 1531912
- SAP Note 1530712
- SAP Note 1511515
- SAP Note 1476226
- SAP Note 1459565
Full note on SAP: SAP Support Launchpad note 1392974
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].