SAP security note 1542355, “BEx Web: Removing DEBUG=X parameter for non-admin users”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
You have used the BEx URL parameter DEBUG=X to analyze command processing of BEx Web Applications. This parameter was influencing the processing by adding additional debug messages with information that could be used to analyze the commands (e.g., path statements processing).
Some internal information was given to the user. Such information, even if not directly providing data to the user, could be incorrectly used to analyze the system’s behavior.
Solution
Usage of the DEBUG parameter by non-administrator users is not allowed. Such a parameter in the URL will be ignored.
If you still want to analyze the processing of web applications during design, consult your administrator to apply this setting as described in note 1128976.
- All users without administrator permissions cannot use the DEBUG=X parameter via URL. Administrator users still can.
- Analysis of internal processing is not possible, even if BEx documentation states that the DEBUG=X parameter can be used. Corresponding documentation will be updated with some delay.
Reason and prerequisites
Potential security issue.
References
- 1526201 – NW BI 7.30 Java: Delivery: SP 1 Patch 01 and SP 2 Patch 01
- 1517315 – NW 7.01 SP 08 Patch Level (PL) 20 for BI Java
- 1517240 – NW7.0 SPS 23 Patch 20 note for BI Java
- 1506722 – Generic Note for BI Java Patches and Support Packages
- 1468307 – SAPBINEWS NW7.01 BI JAVA SP09
- 1468295 – SAPBINEWS NW7.0 BI JAVA SP24
- 1309000 – NW 7.01 and NW 7.02: BI Java Patch Delivery
- 1177022 – 7.30 NW SP 02 Patch Level (PL) 01 for BI Java
- 1128976 – How to Debug a BEx Web Application NW 7.x Java
- 1055581 – Recommendations for Support Package Stacks for BI 7.0
- 1033246 – NW 7.0 (NW04s): BI Java Synchronized Patch Delivery
- 1011241 – Patches for NetWeaver 2004s BI Java Support Package
Affected components
- SAP NetWeaver 7.0 BI Java
- SAP NetWeaver BI 7.01 (SAP NW BI7.0 EhP 1)
- SAP NetWeaver BI 7.30 (SAP NW BI7.30)
- SAP Business Objects Enterprise 4.0 (SAP BOE 4.0)
Full note on SAP: SAP Support Launchpad note 1542355
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].