SAP security note 1537299, "Missing authorization check in HR Distributed-Reporting", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of HR Distributed-Reporting to which access should be restricted. This may result in an escalation of privileges.
Solution
This security note implements a call to Business Add-In HRPAD00AUTH_DIST with a default implementation that restricts the executable reports to those using HR logical databases. This Business Add-In is delivered with Note 1531288.
- Follow the instructions in Note 1531288 to implement the Business Add-In.
- Implement the relevant support package.
- Alternatively, implement the corresponding correction instructions.
Reason and prerequisites
HR Distributed-Reporting does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may lead to undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1537299
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
