SAP security note 445892, "Security gap in mass maintenance", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
When using the mass maintenance feature with ABAP form routines to make changes or display data, the system does not perform an authorization check for S_DEVELOP after applying the advanced correction from Note 304394. This issue persists in the new MASS interface starting from Release 4.6.
Solution
Implement the advanced correction provided in this security note. After applying the correction, the system will correctly query authorization S_DEVELOP for the entry of ABAP source code in the mass maintenance process.
Develop ABAP source code for mass maintenance of field values exclusively in the development client with appropriate development authorization. Store the code as a variant, which can then be transported to the production client using the transactions mentioned in Note 500653. In the production environment, users without development authorization can execute the transported variant.
Reason and prerequisites
The problem stems from a gap in Note 304394, which only closes the security gap in the mass maintenance for the old MASS interface available up to Release 4.5B. The new MASS interface introduced in Release 4.6 requires implementing the AUTHORITY-CHECK at a different program location to ensure proper authorization.
References
- Note 500653 – Find function 'Variant Transport' in the menu
- Note 304394 – Security gap in mass maintenance
Affected components
- SAP_APPL: 46A to 46B
- SAP_APPL: 46C
- SAP_ABA: 620
Full note on SAP: SAP Support Launchpad note 445892
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
