Missing Authorization check in ABAP Server File Interface, SAP security note 2643371

SAP security note 2643371, "Missing Authorization Check in ABAP Server File Interface". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

ABAP Server File Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

Apply the SAP Kernel patch specified in this SAP Note.

If the ABAP application server runs on Microsoft Windows and the SAP Kernel Release is 7.49 or earlier (or 7.71 or 7.72), Problem 3 requires setting the profile parameter abap/path_norm_Windows to 0. This is the default value in SAP Kernel 7.53 and later. For backward compatibility, you can set this profile parameter to other values as described in SAP Note 2634476.

With the SAP Kernel Patch, the behavior changes as follows:

• Ad 1: If a file path contains a null character, the exception CX_SY_FILE_AUTHORITY is raised when the file is accessed, making the behavior the same as if the authorization check with S_DATASET or S_PATH fails.
• Ad 2: Long file paths will not be truncated before they are normalized for the authorization check with S_DATASET and the check with the table SPTH.
• Ad 3: Before a file path is compared with the paths in the customizing table SPTH, it is normalized syntactically, improving the normalization process on Microsoft Windows.

Reason and prerequisites

Problem 1: When the ABAP application server accesses any file in its file system, a null character in the file path is interpreted as the end of the path. However, ABAP code that validates file paths may give wrong results because the ABAP runtime considers a null character as a normal character.

Problem 2: This problem can occur if authorization checks with the authorization object S_DATASET have been configured or file paths have been maintained in the customizing table SPTH (for checks with the authorization object S_PATH). The authorization checks can be bypassed if an attacker can supply a very long file path because the file path is truncated before it is normalized.

Problem 3: If the ABAP application server runs on Microsoft Windows, there are cases in which the SAP Kernel should detect that certain paths lead to the same directory. Otherwise, the check with the authorization object S_PATH may be bypassed by exploiting the non-uniqueness of file paths.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• SAP Note 2827132 – File and directory names with a tilde character on Microsoft Windows
• SAP Note 2459510 – FAQ: Authorization check with S_PATH when accessing files
• SAP Note 2690964 – ST06 doesn’t show Hardware info and Operating system log

Affected components

• 32-Bit: 7.21, 7.21EXT
• 64-Bit Unicode: 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.71, 7.72
• 64-Bit: 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.71, 7.72