SAP Security Note
High priority
SAP security note 1532497, "Potential disclosure of persisted ERP data using CRM Plug-In", is a note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit the IPC-specific CRM Plug-In in ERP or R/3 systems by using specially crafted inputs to modify database commands, resulting in the retrieval of additional information of data persisted by the system.
Solution
- Apply this fix in all listed ERP or R/3 releases, even if the CRM Plug-in is not used in your scenario.
- For PI Releases 2004_1_46C, 2004_1_470, and 2004_1_500, follow the manual implementation steps only: install the attached release-specific ZIP file containing the authorization object IPC_RFC_DB and related structures, and ensure that after installing the ZIP file, the relevant objects have been updated as per the correction instructions.
- For other ERP releases, apply the relevant correction instructions using SNOTE.
Reason and prerequisites
The issue is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user, allowing retrieval of additional data from the database.
CVSS
Score 0
References
- Note 876036 – Authorization check missing in the IPC_READ function group
- Note 885670 – Corrections in the EXTRACT_DATA_IPC module
Affected components
- SAP_APPL 600
- SAP_APPL 602
- SAP_APPL 603
- SAP_APPL 604
- SAP_APPL 605
- PI 2004_1_46C
- PI 2004_1_470
- PI 2004_1_500
Full note on SAP: SAP Support Launchpad note 1532497
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].