SAP Security Note
High priority
SAP security note 1553836, “Missing authorization check in Service Data Download”, is a program error note released on 12.04.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use display functions to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the newest ST-PI support package or apply the correction instruction via SAP Note Assistant.
Reason and prerequisites
Service Data Download does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
References
- SAP Note 1282401 – for ST-PI versions from 2008_1_46C to 2008_1_710
- SAP Solution Manager: Basic functions 7.1 SP1
Full note on SAP: SAP Support Launchpad note 1553836
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].