Missing Authorization check in SAP NetWeaver ADBC Demo Programs, SAP security note 2423486

SAP security note 2423486, “Missing Authorization check in SAP NetWeaver ADBC Demo Programs”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

ADBC Demo Programs do not perform necessary authorization checks for an authenticated user, which may result in escalation of privileges.

Impacts of Missing Authorization Checks:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

The correction implements an authority check on S_PROGRAM with fields P_GROUP (ADBC_Q) and P_ACTION (SUBMIT).

Steps to Resolve:

• Support Package Installation: Implement the Support Package mentioned in this SAP Note relevant to your SAP_BASIS version.
• Manual Activity: Maintain table TPGP using transaction SM30 with the following entry for each applicable release: Application: A, Authorization Group: ADBC_Q, Text: ADBC – Native Database Queries.

Reason and prerequisites

The attacker must be a valid user with either SE38 or SA38 authorization.

CVSS

Score 6.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected components

• SAP_BASIS: 700, 701, 702, 710, 711, 730, 731, 740, 750, 751