SAP security note 1480212, "Report BEFG_SOURCE_EXTRACT must not be used in production", is a program error note released on 14.12.2010. Below are the symptom and the SAP recommended solution.
Description
Symptom
The program BEFG_SOURCE_EXTRACT can be used to modify a standard template of the Billing Engine Framework in the production system. Authorization checks are not performed before executing this program. Although a potential attacker must be able to transport their modifications into the system before executing the program BEFG_SOURCE_EXTRACT, user input is not accepted directly.
Thus, the potential risk exists that the business behavior of the billing application is influenced in the production system.
Solution
The program BEFG_SOURCE_EXTRACT is enhanced to prevent execution in a production system. Additionally, the corresponding permission of authorization object BEF_META is checked.
Reason and prerequisites
The program was developed as part of the Billing Engine Framework to utilize developers splitting includes or programs into templates. These templates cannot be executed in any system but are the basis for the Framework to generate the corresponding objects of the Billing Engine Application, which can be either a function module or a program.
The potential security issue exists if the program is executed in the production system and modifies the template of an existing object of the Billing application. Therefore, a function module or program must be part of the production that can be used as a source for the template information.
If a user has permission to regenerate the billing application (which requires authorization object BEF_META), the programs of the productive Billing application can be changed as well.
Full note on SAP: SAP Support Launchpad note 1480212
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].