SAP Security Note
Medium priority
SAP security note 2150625, “Potential disclosure of persisted data in SAP CPQ Solution Sales Configuration”, is a note released on April 5, 2015. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can exploit the SAP CPQ Solution Sales Configuration by using specially crafted inputs to modify SQL statements. This manipulation can lead to the retrieval of additional information stored in the system’s database.
Solution
To mitigate this vulnerability, the following steps must be taken:
- Apply Java Patches: FBS_SOLCONF_IPC 1.0 SP05 Patch 8 (for deployment on SAP AS Java) and FBS_SOLCONF_SME 1.0 SP05 Patch 8 (for update of Solution Modeling Environment). These Java patches are backward compatible and function correctly with or without the subsequent ABAP corrections.
- Implement ABAP Corrections: After applying the Java patches, follow the manual steps provided in the attached documents and apply the source code corrections as outlined in the SAP Note.
- Update Authorizations: A new PFCG role is introduced to authorize access to SAP standard tables related to product configuration. If custom tables are in use or any tables are missing from the provided list, add them to the new PFCG role. To verify missing authorizations, launch configuration in the CRM/ECC system, navigate to Netweaver Administration > Troubleshooting > Log and Traces > Log Viewer > View > Open View > Developer Trace > Filter on error, and check for any missing authorizations related to the PFCG role. Additionally, use the SU53 transaction to identify any missing authorizations when prompted.
Reason and prerequisites
The vulnerability stems from an SQL injection flaw where the application constructs SQL statements with user-controllable input without proper sanitization. This allows attackers to alter the SQL commands executed by the database.
References
Full note on SAP: SAP Support Launchpad note 2150625
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].