SAP security note 1831266, "Missing authorization check in BC-XI-IS". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can exploit functions within BC-XI-IS that should have restricted access. This vulnerability may lead to an escalation of privileges.
Solution
To remediate this issue, apply the correction or patch level provided in this note. Be aware that applying this note may impact message processing:
- After applying, message processing will fail if attempted by a user without the necessary authorizations.
- In case of authorization errors, extend the relevant user authorities by assigning the following: Object S_XMB_AUTH, Field RUNTIME, Activity 16 (Execute).
You can download the patch for SNOTE here or view the PDF version here.
Reason and prerequisites
BC-XI-IS lacks proper authorization checks for certain functions. As a result, authenticated users might gain unauthorized access, leading to undesired system behavior.
References
Affected components
- SAP_BASIS versions 640 to 740
Full note on SAP: SAP Support Launchpad note 1831266
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
