SAP security note 1903756, "DB6: Authorization to execute operating system commands", is a security note. Below are the symptom and SAP recommended solution.
Description
Symptom
You can execute operating system commands using the infrastructure of the DBA Cockpit. The usage of this infrastructure is not secured by SAP authorizations and is not only restricted to reading operating system commands.
Solution
This error is corrected by the relevant Support Package. For an advanced correction, you can implement the correction instructions.
The correction ensures that changing operating system commands can no longer be executed. Read commands can only be executed if the user has the authorization for the authorization object S_ADMI_FCD.
Reason and prerequisites
This problem occurs because an authorization check is missing.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1903756
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
