SAP security note 1488211, "Potential disclosure and modification of persisted data", is a note. Below are the symptom and the SAP recommended solution.
Description
Symptom
A malicious user can exploit some RFC-enabled function modules in package WRB and use specially crafted inputs to execute arbitrary database commands to retrieve, modify, or remove data persisted by the system. Depending on the input, the user can induce aborts (short dumps) in the system.
Solution
Based on additional input data validation checks, the system avoids short dumps in case of erroneous input data and instead sets a return code appropriately. To achieve this, please apply the correction instructions of this note or implement the corresponding Support Package.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it. Due to insufficient data validation checks, the erroneous input data can cause a short dump and abort the execution. This can influence the system stability if a flood of short dumps gets induced.
Full note on SAP: SAP Support Launchpad note 1488211
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
