Remote Code Execution in SAP MII due to Malicious JSP Code Injection

CVE-2021-21480

Summary

SAP MII facilitates the creation and saving of dashboards as JSP through the Self Service Composition Environment (SSCE). A security flaw allows an attacker to intercept server requests, injecting malicious JSP code. When a user with the SAP_XMII Developer role opens a compromised dashboard, this code executes, enabling remote code execution on the server. This could lead to privilege escalation and allows the attacker to execute OS commands that can read, modify, or delete sensitive files on the server. Consequently, the confidentiality, integrity, and availability of the server are severely compromised, posing significant risks to the hosting environment of SAP MII applications.

References