SAP Security Note
High priority
SAP security note 2798743, "[CVE-2019-0349] Missing Authorization Check in SAP Kernel (ABAP Debugger)", is a program error note released on 13.08.2019. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Kernel (ABAP Debugger) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Some well-known impacts of Missing Authorization check are:
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
The solution introduces in debugging of update task the authorization check S_DEVELOP with values OBJTYPE = "DEBUG" and ACTVT = "02".
The solution is provided as a patch for the disp+work package of the SAP Kernel. Please make sure you’re using a disp+work package with patch number at least as the one mentioned in section "Support Packages & Patches".
Reason and prerequisites
This issue is caused by a bug in the disp+work package of the SAP kernel, which does not validate authorization correctly. The bug affects all SAP Business Software built on ABAP Server. For example, these products are SAP NetWeaver, SAP ERP, SAP S/4HANA.
CVSS
Score 7.2 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected components
- KRNL32NUC 7.21
- KRNL32NUC 7.21EXT
- KRNL32UC 7.21
- KRNL32UC 7.21EXT
- KRNL64NUC 7.21
- KRNL64NUC 7.21EXT
- KRNL64NUC 7.22
- KRNL64NUC 7.22EXT
- KRNL64NUC 7.49
- KRNL64UC 7.21
- KRNL64UC 7.21EXT
- KRNL64UC 7.22
- KRNL64UC 7.22EXT
- KRNL64UC 7.49
- KRNL64UC 7.53
- KRNL64UC 7.73
- KERNEL 7.21 to 7.22
- KERNEL 7.49
- KERNEL 7.53
- KERNEL 7.73
- KERNEL 7.75
- KERNEL 7.76
- KERNEL 7.77
Full note on SAP: SAP Support Launchpad note 2798743
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].