SAP security note 2166077, “Missing authorization check in ABAP Workbench”. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of ABAP Workbench to which access should be restricted. This may result in an escalation of privileges.
Solution
The correction provided in this SAP Note introduces an additional authorization check S_DEVELOP with activity "03" for display operations. To remediate this issue, implement the relevant Support Package or follow the correction instructions outlined in the SAP Note.
Reason and prerequisites
ABAP Workbench does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This omission may lead to undesired system behavior and potential privilege escalation.
CVSS
Score 4.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Full note on SAP: SAP Support Launchpad note 2166077
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].