CVE-2021-27602 Code injection in SAP Commerce

Critical 9.9 Published 13 Apr 2021 Updated 3 Aug 2024

Authorized users can inject malicious code into source rules, leading to remote code execution and full application compromise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27602?

CVE-2021-27602 is a critical code injection vulnerability in SAP Commerce, published on 13 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality, integrity and availability of the application.

Weakness: CWE-94

Which versions are affected by CVE-2021-27602?

It affects 1 product.

Products include Sap Commerce.

How do I fix CVE-2021-27602?

No fix has been published for CVE-2021-27602 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-27602 being exploited?

There is no known exploitation of CVE-2021-27602 in the wild and no public exploit code.

Sources

Also known as GHSA-cpjq-97hc-mc3c.