Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in UME Access Control List API, SAP security note 1560606

SAP Note 1560606

SAP security note 1560606, "Missing authorization check in UME Access Control List API", is a note. Below are the symptom and SAP recommended solution.

ComponentBasis Components > NetWeaver Application Server Java > Security, User Management > ACLs, J2EE Roles, UME Actions (BC-JAS-SEC-AUT)

Description

Symptom

An authenticated user can use functions of the User Management Engine Access Control List (ACL) API to which access should be restricted. This may result in an escalation of privileges.

Solution

To address this security vulnerability, you should deploy the latest patch for your corresponding product and service pack from the SAP Service Marketplace:

  • SERVERCORE.SCA (for releases 7.10 and higher)
  • SAP-JEECOR.SCA (for releases 6.40 and 7.0)
  • SAP-JEE.SCA (for releases lower than 6.40)

Additionally, as a workaround, applications using the User Management Engine ACL API can implement their own ACL owner check before calling interface methods that modify or delete an ACL.

Full note on SAP: SAP Support Launchpad note 1560606

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#ACL #UME #J2EE Roles #Authorization

Explore More