SAP Security Note
High priority
SAP security note 1530392, "Missing Authorization Check in SW-Delivery tools", is a program error note released on February 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functionality of the transport & SW-delivery tools to which access should be restricted. This can potentially result in an escalation of privileges. If the user has RFC authorization for these particular objects, it enables the user also to submit reports.
Solution
Import the relevant Support Package or apply the SNOTE corrections. The corrections do not influence the normal functions of the application, and no further adjustments or configurations are required, since these objects contain SAP-internal functionality.
Reason and prerequisites
SW-delivery tools lack permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.
References
This note refers to
Affected components
- SAP_APPL (31I, 40B, 45B)
- SAP_BASIS (46B to 46D, 610 to 640, 700 to 702, 710 to 730)
Full note on SAP: SAP Support Launchpad note 1530392
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].