SAP Security Note
High priority
SAP security note 1388864, “ABAP web services authorization check does not work”, is a note released on 20.10.2009. Below are the symptom and SAP recommended solution.
Description
Symptom
Authorization check for SOAP web service calls is not working due to a program error. This only affects the start authorization check against authorization object S_SERVICE. It does not affect other authorization checks called by the underlying web service implementation (e.g., a BAPI, an RFC function module, or an ESR modeled service).
Solution
Implement the attached correction instructions using transaction SNOTE.
Reason and prerequisites
The issue occurs in systems on specific service packs or with certain notes implemented.
Service Packs:
- AS ABAP 7.00 SP19, SP20
- AS ABAP 7.01 SP04, SP05
- AS ABAP 7.10 SP08
- AS ABAP 7.11 SP02, SP03
- AS ABAP 7.20 SP00, SP01
Relevant Notes:
Full note on SAP: SAP Support Launchpad note 1388864
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].