SAP security note 2407670, "Missing Authorization check in ABAP Development Tools", released on January 10, 2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
- ABAP Development Tools bypass necessary authorization checks.
- Escalation of privileges for authenticated users.
Impacts of Missing Authorization Check:
- Abuse of functionalities restricted to specific user groups.
- Unauthorized reading, modification, or deletion of restricted data.
Solution
A correction has been introduced to implement an authorization check requiring S_DEVELOP (OBJTYPE = CLAS, ACTVT = 16). To resolve this issue, apply the relevant Support Package mentioned in this SAP Note or follow the provided correction instructions.
Reason and prerequisites
A user with the S_DEVELOP authorization is required to connect to the backend and start ABAP Development Tools. The vulnerable class implements an interface of ADT, allowing developers to execute the class from ADT without appropriate authorization checks. Consequently, a malicious user can execute unauthorized ABAP code.
Affected components
- SAP_BASIS 740 to 740
- SAP_BASIS 750 to 751
Full note on SAP: SAP Support Launchpad note 2407670
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].