Researchers discovered what they believe to be a critical vulnerability in a PwC product designed for securing SAP systems, but the vendor has downplayed the risk of attacks.
Experts at ESNC, a Germany-based company that specializes in SAP security, found the remote code execution vulnerability in PwC’s Automated Controls Evaluator (ACE) tool. The ACE product, which is designed to analyze SAP security settings and identify potential weaknesses, requires two ABAP (Advanced Business Application Programming) files to be run on the production system.
According to an advisory published by ESNC, the ACE software vulnerability can be exploited to remotely inject and execute malicious ABAP code on the targeted SAP system.
“Based on the business processes implemented on the SAP systems on which ACE is installed, this security vulnerability may allow an attacker to e.g. manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions,” researchers said in an advisory. “This activity may result in fraud, theft or manipulation of sensitive data including PII such as customer master data and HR payroll information, unauthorized payment transactions and transfer of money.”
An attack can be launched from the local network and possibly even from the Internet. ESNC researcher Ertunga Arsal told SecurityWeek that the attacker needs to be authenticated on the SAP system in order to exploit the flaw.
“Exploitation is pretty straightforward,” Arsal said. “Malicious ABAP shellcode may be pasted to the vulnerable text input field of the PwC ABAP application to exploit it in its simplest form. It can also be executed via the Internet if the SAP system has public interfaces and ITS services such as WebGui are enabled.”
ESNC reproduced the vulnerability, tracked as CVE-2016-9832, on ACE 8.10.304. The issue has been addressed by PwC in the latest version of the tool.
“The code referenced in this bulletin is not included in the current version of the software which is available to limited clients. The bulletin describes a hypothetical and unlikely scenario – we are not aware of any situation in which it has materialized,” a PwC spokeswoman said in an emailed statement.
ESNC noted in its advisory that it received two cease and desist letters from PwC’s legal team. However, the vendor said the letters were not related to the security analysis itself.
“ESNC did not receive authorized access or a license to use this software. The software is not publicly available and was only properly accessed by those with licenses, such as PwC clients working with trained PwC staff,” PwC told SecurityWeek.
Related Reading: SAP Patches OS Command Execution Vulnerabilities
Related Reading: Vulnerability Impacts Web-Exposed SAP Systems
Related Reading: SAP Patches Multiple Implementation Flaws
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
Latest News
- Fraudulent “CryptoRom” Apps Slip Through Apple and Google App Store Review Process
- US Downs Chinese Balloon Off Carolina Coast
- Microsoft: Iran Unit Behind Charlie Hebdo Hack-and-Leak Op
- Feds Say Cyberattack Caused Suicide Helpline’s Outage
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
