SAP security note 1452946, "Potential information disclosure relating to Payload Data", released on 14.06.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can discover information relating to payloads of PI Messages. This information could be used to allow the malicious user to specialize their attacks against PI payloads.
Solution
The security gap is closed with the implementation of an authority check. It verifies whether the user requesting to see the payload attributes of a message has the necessary permissions.
Reason and prerequisites
Information such as the content of single fields of message payloads can be discovered using PI User-defined Search. This information may be used by a malicious user to further target PI.
References
Affected components
- MESSAGING (7.11)
- SOAMONBASIC (7.11)
Full note on SAP: SAP Support Launchpad note 1452946
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].