Missing authorization check in OAuth2 Server Runtime, SAP security note 2269315

SAP security note 2269315, “Missing authorization check in OAuth2 Server Runtime”. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user (with a valid OAuth2 access token) can use OData services to which access should be restricted using OAuth2 scopes. This may result in an escalation of privileges.

Solution

Apply the ABAP correction instructions provided in the note.

Additionally, apply SAP note 2255477 titled “OAuth enablement for OData Services.” Without this note, OData service calls that worked previously (because of the missing authorization check problem) might fail with an exception.

Reason and prerequisites

In special situations (ICF configuration), the OAuth2 Server Runtime does not perform the required scope checks. This may result in undesired system behavior.

CVSS

Score 6.3 / 10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L