Possible disclosure of saved destination data, SAP security note 1422625

SAP security note 1422625, "Possible disclosure of saved destination data". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can make specific entries to ensure a report outputs data for any destination (for example, internal destinations) and not only for the destinations of type 3 that are intended in the report (ABAP connections) and T (TCP/IP connections).

Solution

Import the relevant Support Package. In the corrected source code, the dynamic WHERE clause has been removed and replaced with a case distinction for the SQL statement that is used. This prevents the SQL injection.

Reason and prerequisites

The cause of the problem is an SQL injection vulnerability. In the source code, an SQL statement is composed of strings. In this case, an attacker can obtain control of the contents of a substring. Therefore, the attacker can manipulate the resulting entire SQL statement and execute it with the rights of the database user who is logged on.

In this case, the attacker can display the data of all destinations, but not the passwords of the logon users that are entered in the connection data. The attacker cannot create new destinations or change or delete existing destinations. The reading of destinations still always requires (including those read without permission) the authorization S_RFC_ADM.

Affected components

• Basis Components > Middleware > RFC (BC-MID-RFC)
• SAP_BASIS 620 to 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 720