SAP security note 1537215, “Hard-coded credentials in BC-MOB-DOE-BEI”. Below are the symptom and SAP recommended solution.
Description
Symptom
BC-MOB-DOE-BEI contains code that changes the program’s behavior when a user is successfully authenticated with a certain username.
A malicious user can be authenticated to BC-MOB-DOE-BEI without having their own legitimate credentials, or they may escalate privileges.
Solution
Hardcoded username is removed from the Function modules.
- Apply SP12 for WebAS 7.10
- OR apply SP07 for WebAS 7.11
Reason and prerequisites
The program code contains a hard-coded username-password combination in the program’s source code. A malicious user who specifies these credentials can log on to the system without having been assigned legitimate access by the system administrator(s). If a user already has privileges with which they can log on, an escalation of privileges may be possible if the hard-coded account has higher access rights than the original user.
Pre-requisites: you are on SP08 – SP11 of WebAS 7.10, or you are on a Support Package lower than SP07 of WebAS 7.11.
Full note on SAP: SAP Support Launchpad note 1537215
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
