SAP security note 2433458, "Missing Authorization check in ABAP Debugger". Below are the symptom and SAP recommended solution.
Description
Symptom
The ABAP Debugger lacks proper authorization checks, enabling authenticated users to abuse functionalities restricted to specific user groups. This can result in unauthorized reading, modification, or deletion of restricted data.
Solution
The correction in this SAP Note introduces a separate authorization check for script execution when a user has only display rights for debugging. This ensures that executing debugger scripts requires explicit authorization, thereby preventing unauthorized privilege escalation.
Reason and prerequisites
The ABAP Debugger differentiates between display and change authorization. However, the ability to execute debugger scripts is implicitly tied to display authorization. In certain scenarios, this can unintentionally leverage permissions, especially if the script performs changes.
CVSS
Score 4.1 Vector: NHHN | U | LLL (CVSS v3.0)
Full note on SAP: SAP Support Launchpad note 2433458
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].