SAP Security Note
High priority
SAP security note 1386926, "Security issue in an expert application for XI support", is a program error note released on 22.02.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
A user can perform administrative actions in an expert application used for XI product support without having modification rights. Currently, having display rights is sufficient. This application allows users to view logs from the Message Archiving and logs from the data aggregation job of the Message Overview. It is intended solely for use by support experts, not by customers.
Solution
The code has been enhanced to include additional security checks, ensuring that only users with modify rights can access these functionalities. The correction is included in the following (and newer) Support Packages:
- XI 7.0 SP21
- XI 7.01 SP06
- XI 7.02 SP02
- PI 7.10 SP10
- PI 7.11 SP05
Older XI releases (XI 3.0) do not contain this functionality and are not affected.
Reason and prerequisites
The application does not perform specific checks for modification rights. However, it does check for display rights.
Full note on SAP: SAP Support Launchpad note 1386926
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].