Report BEFG_TEMPLATE_CREATE must not be used in production, SAP security note 1375125

SAP security note 1375125, "Report BEFG_TEMPLATE_CREATE must not be used in production", is a program error note released on December 9, 2009. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The program BEFG_TEMPLATE_CREATE can be used to modify a standard template of the Billing Engine Framework in the production system. Authorization checks are not performed before executing this program. Although a potential attacker must be able to transport modifications into the system before executing the program BEFG_TEMPLATE_CREATE, user input is not accepted directly.

Thus, the potential risk exists that the business behavior of the billing application is influenced in the production system.

Solution

Enhancements have been made to the program BEFG_TEMPLATE_CREATE to ensure it cannot be executed in a production system. Additionally, the corresponding permissions of the authorization object BEF_META are now checked.

Apply the correction instruction provided in the support package.

Reason and prerequisites

The program was developed as part of the Billing Engine Framework to assist developers in converting function modules or programs into templates. These templates cannot be executed in any system but serve as the basis for the Framework to generate the corresponding objects of the Billing Engine Application, which could be either a function module or a program.

The potential security issue arises if the program is executed in the production system and modifies the template of an existing object of the Billing application. Therefore, a function module or program must be part of the production environment to be used as the source for the template information.

If a user has the permission to regenerate the billing application (which requires the authorization object BEF_META), the programs of the productive Billing application can be altered as well.

References

Affected components

• BBPCRM: 300
• BBPCRM: 310
• BBPCRM: 400
• BBPCRM: 500
• BBPCRM: 510
• BBPCRM: 520
• BBPCRM: 600
• BBPCRM: 700

CVSS

Score 0