PT-2023-22157 · Sap · Sap Application Interface Framework

Published 2023-04-11 · Updated 2023-04-18 · CVE-2023-29109

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP BASIS 755, 756, SAP ABA 75C, 75D, 75E

Description The application allows an Excel formula injection, enabling an authorized attacker to inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed, potentially causing limited impact on the confidentiality and integrity of the application.

Recommendations For versions AIF 703, AIFX 702, S4CORE 101, SAP BASIS 755, 756, SAP ABA 75C, 75D, 75E, consider disabling the Custom Hints List feature until a patch is available to prevent Excel formula injection. Restrict access to the Tooltip field to minimize the risk of exploitation. Avoid using the Custom Hints List feature in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2023-29109

Affected Products

Sap Application Interface Framework

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29109 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29109 · Vendor Advisory
• https://t.me/cvenotify/47968 · Telegram Post
• https://t.me/cibsecurity/61830 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3115598 · Note