Missing Authorization check in ABAP File Interface, SAP security note 2433777

SAP security note 2433777, "Missing Authorization check in ABAP File Interface", is a program error note released on 09.05.2017. Below are the symptom and SAP recommended solution.

Description

Symptom

The ABAP File Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This can lead to:

• Abuse of functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

Apply the relevant Support Package mentioned in this SAP Note or follow the correction instructions. File names with control characters are no longer accepted, and the implicit authorization check in the ABAP statements OPEN DATASET and DELETE DATASET will always fail, raising the catchable exception CX_SY_FILE_AUTHORITY.

If the stricter check causes disruptions, set the following profile parameter in the instance profile to enable the old behavior:

abap/path_normalization = res

Reason and prerequisites

An authenticated user with appropriate business user rights may bypass access control if a file name or path name contains control characters in the range 0x01 through 0x1F, causing the authority check in customizing table SPTH to fail.

CVSS

Score 4.1

References