Potential disclosure of persisted data in test code, SAP security note 1591813

SAP security note 1591813, "Potential disclosure of persisted data in test code", is a program error note released on 09.08.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit a function module originally intended for testing purposes by using specially crafted inputs. This exploitation allows the user to modify database commands, resulting in the retrieval of additional information that the system has persisted.

Solution

Apply the recommended corrections provided in the security note. Specifically, implement the following steps:

• Correction call transaction SE37: enter the function module name CATT_ATTRIBUTE_SELECT, then click Change.
• Modify the function module: comment out the entire code of the function module up to the statement ENDFUNCTION, then save and activate.

For releases 3.1I to 4.5, automated note implementation is not possible. The above manual steps are required to mitigate the vulnerability.

Reason and prerequisites

The vulnerability arises from an SQL injection flaw. The problematic code constructs an SQL statement incorporating strings that can be manipulated by a malicious user. This altered SQL statement can then be used to extract data from the database, leading to unauthorized access to sensitive information.

References

• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_APPL: 31I to 605