SAP security note 1607917, “Missing authorization check in RFC API of ABAP Workbench”, is a note. Below are the symptom, SAP recommended solution and CVSS score.
Description
Symptom
An authenticated user can use functions of the RFC API of the ABAP Workbench to which access should be restricted. This may result in an escalation of privileges.
Solution
Apply the support package mentioned in this note, specifically the following:
- For SAP_APPL 45B: Apply Support Package SAPKH45B67
- For SAP_BASIS 46C: Apply Support Package SAPKB46C63
Additionally, create the exception NOT_AUTHORIZED for the following function modules before implementing the coding changes:
- RFC_READ_DYNPRO
- RFC_READ_REPORT
- RFC_READ_DEVELOPMENT_OBJECT
Reason and prerequisites
The RFC API of the ABAP Workbench lacks proper authorization checks for certain functions. This oversight allows authenticated users to access functionalities that should be restricted, potentially leading to unauthorized privilege escalation and undesired system behavior.
Exploiting this vulnerability can allow an attacker with authenticated access to perform actions beyond their intended permissions, compromising the integrity of the system.
CVSS
Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N
Full note on SAP: SAP Support Launchpad note 1607917
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].