Potential disclosure and modification of code and data, SAP security note 1520781

SAP security note 1520781, "Potential disclosure and modification of code and data", is a program error note released on 11.01.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

PRA contains code that permits the execution of arbitrary program code of the user’s choice. A malicious user can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.

A malicious user can exploit PRA (Production and Revenue Accounting) and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.

Solution

Applying the note will protect the application from the following vulnerabilities:

• Dynamic SQL Injection
• Code Injection

Hence, applying the note will prevent the PRA application from the above-mentioned security vulnerabilities.

Reason and prerequisites

The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is required.

Depending on the code, the user can:

• Inject and run their own code
• Obtain additional information that should not be displayed
• Modify data, delete data
• Modify the output of the system
• Create new users with higher privileges
• Perform a denial of service attack

There is also an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or to modify the data.

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)
• 1509344 – Potential disclosure and modification of persisted data

Affected components

• IS-OIL 600 to 600
• IS-OIL 602 to 602
• IS-OIL 603 to 603
• IS-PRA 604 to 604
• IS-PRA 605 to 605