Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in ABAP Dump Collector, SAP security note 1686842

SAP Note 1686842
SAP Security Note
High priority

SAP security note 1686842, “Missing authorization check in ABAP Dump Collector”, is a program error note released on July 10, 2012. Below are the symptom and SAP recommended solution.

ComponentBasis Components > ABAP Runtime Environment – ABAP Language Issues Only > Syntax, Compiler, Runtime
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version2
StatusReleased for Customer
Released onJuly 10, 2012
LanguageEnglish

Description

Symptom

An authenticated user can use functions of ABAP Dump Collector to which access should be restricted. This may result in an escalation of privileges.

Solution

The correction introduces authorization checks for ST22 and submission of reports.

  • For ST22: by authorization object S_TCODE.
  • For execution of the offered reports: by the authorization objects S_DEVELOP and S_PROGRAM.

The correction is provided either by the support packages mentioned in this note or the correction instructions.

Reason and prerequisites

ABAP Dump Collector does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

Full note on SAP: SAP Support Launchpad note 1686842

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #Authorization check #ST22 #ABAP Dump Collector

Explore More