Potential information disclosure relating to payload data, SAP security note 1707816

SAP security note 1707816, “Potential Information Disclosure in SAP_ABA (CA-FS-ECH)”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can access information about the payload in postprocessing orders. This exposes sensitive data such as credit card details, enabling attackers to tailor their attacks.

Solution

To mitigate this vulnerability, SAP advises the following steps:

• Encrypt payloads: store the payloads of postprocessing orders in an encrypted format within the database.
• Implement the support package: import the specified support package from this note to obtain the necessary documentation and updated package structure.
• Advance correction (optional): if planning to activate encryption in advance, implement the correction from Note 1707878 to prevent program terminations.
• Configure encryption: use transaction SM30 to maintain the view ECHVC_ENCRYPTION, assign a private address book for SSF (encryption key) to the relevant business processes, define the encryption key and Personal Security Environment (PSE) using transactions SSFA and STRUST, and activate encryption settings following SAP’s detailed instructions in the note.

Implementing this correction may introduce changes in system behavior related to encryption processes. See Note 2338022 for information on potential syntax errors in classes CL_FEH_DB_PAYLOAD and CL_FEH_MESSAGE_PERSISTENCY after implementation.

References

• 1707878: Additional Correction for Encryption Activation
• 2338022: Syntax error in classes after implementing Note 1707816

Affected components

• SAP_ABA: 711, 730, 731
• SAP_BS_FND: 701, 702