SAP Security Note
Medium priority
SAP security note 2069820, “Missing authorization check in BW-BEX-ET”, is a program error note released on 19.08.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of BW-BEX-ET to which access should be restricted. This may result in an escalation of privileges.
Solution
To resolve this issue, apply the following Support Packages relevant to your SAP BW version:
- SAP Business Warehouse (SAP BW) 7.0: Import Support Package 35 for SAP BW 7.00 (SAPKW70035) into your BW system. This Support Package will be available once SAP Note 2009937 titled "SAPBWNews NW BW 7.0 ABAP SP35" is released.
- SAP BW 7.01 (SAP BW 7.0 EHP 1): Import Support Package 18 for SAP BW 7.01 (SAPKW70118) into your BW system. Available upon release of SAP Note 2123573 titled "SAPBINews NW7.01 BW ABAP SP18".
- SAP BW 7.02 (SAP BW 7.0 EHP 2): Import Support Package 18 for SAP BW 7.02 (SAPKW70218) into your BW system. Available upon release of SAP Note 2126275 titled "Preliminary Version SAPBWNews NW BW 7.02 ABAP SP18".
- SAP BW 7.11: Import Support Package 16 for SAP BW 7.11 (SAPKW71116) into your BW system. Available upon release of SAP Note 2199125 titled "Preliminary Version SAPBINews NW7.11 BW ABAP SP16".
- SAP BW 7.30: Import Support Package 15 for SAP BW 7.30 (SAPKW73015) into your BW system. Available upon release of SAP Note 2199121 titled "SAPBWNews NW7.30 BW ABAP SP15".
- SAP BW 7.31 (SAP BW 7.3 EHP 1): Import Support Package 18 for SAP BW 7.31 (SAPKW73118) into your BW system. Available upon release of SAP Note 2206236 titled "Preliminary Version SAPBWNews NW BW 7.31/7.03 ABAP SP18".
- SAP BW 7.40: Import Support Package 14 for SAP BW 7.40 (SAPKW74014) into your BW system. Available upon release of SAP Note 2207824 titled "Preliminary Version SAPBWNews NW BW 7.4 ABAP SP14".
- SAP BW 7.50: Import Support Package 2 for SAP BW 7.50 (SAPK-75002INSAPBW) into your BW system. Available upon release of SAP Note 2220381 titled "Preliminary Version SAPBWNews NW BW 7.50 ABAP SP2".
Additionally, you can use the correction instructions provided. Before applying the correction instructions, ensure you review SAP Note 1668882 for transaction SNOTE. This SAP Note might already be available before the Support Package is released; however, the short text may still contain the term "preliminary version".
Full note on SAP: SAP Support Launchpad note 2069820
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].