SAP S/4HANA ABAP Code Injection Vulnerability via RFC

A vulnerability in SAP S/4HANA allows an attacker with user privileges to inject arbitrary ABAP code into the system through a function module exposed via RFC. This exploitation bypasses critical authorization checks, effectively creating a backdoor that could lead to a complete system compromise. The vulnerability jeopardizes the system's confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability could result in a full system compromise, allowing unauthorized access and control over the SAP S/4HANA system.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP for Me platform, specifically in the Security Notes section. For details on the next SAP Security Patch Day, refer to the SAP Security Patch Day Bulletin Archive.