BRF+ Syntax error and code injection vulnerability, SAP security note 1556438

SAP security note 1556438, "BRF+: Syntax error and code injection vulnerability", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

• Generation of a class results in a syntax error: "Literals that take up more than one line are not permitted."
• Mishandling of the character "`" enables malicious users to execute arbitrary code.
• Potential for unauthorized system behavior control or privilege escalation through malicious code execution.

Solution

Implement the correction provided in Download for SNOTE or view the PDF Version.

References

• Related SAP Note 888889: Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS 701
• SAP_BASIS 702
• SAP_BASIS 730