SAP security note 2307494, "Missing Authorization Check in TREX ABAP+JAVA API". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The TREX Function Module does not enforce proper authorization checks, which can lead to:
- Abuse of functionalities restricted to specific user groups.
- Unauthorized read, modification, or deletion of restricted data.
While this Function Module primarily deletes TREX trace data without affecting business or system data, the lack of authorization checks poses a security risk.
Solution
To mitigate this vulnerability:
- Implement Correction Instructions: apply the correction instructions provided in the security note to enforce proper access restrictions.
- Upgrade if Possible: consider upgrading to a newer SAP_BASIS release where the affected Function Module is not present.
No adverse impact on existing functionalities is expected after applying the security measures.
Reason and prerequisites
The vulnerability arises due to a missing authorization check in the TREX_INT_DELETE_ABAP_TRACE function for SAP_BASIS releases 700, 701, and 702. This issue has been resolved in newer SAP_BASIS releases where the Function Module is no longer implemented.
CVSS
Score 4.4 Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected components
- SAP_BASIS (700 to 702)
Full note on SAP: SAP Support Launchpad note 2307494
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].