SAP security note 2368082, "Information Disclosure in ABAP Development Environment". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Under certain conditions, the ABAP Development Environment allows an attacker to access information that would otherwise be restricted.
Some well-known impacts of Information Disclosure are:
- Loss of information and system configuration confidentiality
- Information gathering for further exploits and attacks
Solution
The solution isolates some of the tools from each other. For example, if the text editor (transaction SE61) is configured, access to other developer tools is not possible anymore.
Please implement the Support Package mentioned in this SAP Note or apply the correction instructions.
Reason and prerequisites
Via user-specific settings, various tools within the ABAP Development Environment can be accessed. This enables a malicious user to get to know about development objects not accessible otherwise. Note that the object details are not accessible if the appropriate authorization is missing.
References
Affected components
- SAP_BASIS version 740 to 740
- SAP_BASIS version 750 to 751
Full note on SAP: SAP Support Launchpad note 2368082
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
