Potential code injection in Extraction & Reporting Services, SAP security note 1679198

SAP security note 1679198, "Potential code injection in Extraction & Reporting Services". Below are the symptom and SAP recommended solution.

Description

Symptom

Generic Ad Hoc Reporting customizing allows generating reports containing code that permits the execution of arbitrary program code of the user’s choice. An attacker can control the behavior of the system or potentially escalate privileges by executing malicious code without having legitimate credentials.

Solution

Implement the attached correction or the corresponding support package. To correct the existing potential code injection, follow these steps to regenerate existing RRI customizing entries:

• Access the IMG activity "Configure Receiver Reports for Drill-Through" (view /BA1/FP_VRRI).
• Generate receiver reports for BI drill-through by selecting one of the following report categories: SDL ad hoc reporting, generic ad hoc reporting, drill-through using CVMP.
• Update customizing entries: for each existing entry, double-click on it in change mode. Change the title description and save it. If necessary, undo your title modification and save again. This action changes the entry status to "not generated."
• Regenerate reports: use the "regenerate receiver report" button to regenerate the receiver report using the new note correction.

As a result, the code injection risk in this IMG activity is eliminated.

Reason and prerequisites

The program code allows defining and executing user-defined code that changes the system’s behavior. A valid and authenticated user is not required.

Depending on the code, a user can:

• Inject and run their own code
• Obtain additional information that should not be displayed
• Modify or delete data
• Modify the output of the system
• Create new users with higher privileges
• Perform a denial-of-service attack