SAP Note 2604054
SAP Security Note
High priority
SAP Security Note
High priority
SAP security note 2604054, "Missing Authorization check in Printworkbench", is a program error note released on 26.06.2018. Below are the symptom and SAP recommended solution.
Description
Symptom
Printworkbench does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
The affected functions have now been enforced to properly check access restrictions. Implement the correction instructions with transaction SNOTE.
References
- 2645906 – EFRM application form runtime error MESSAGE_TYPE_X for USER-EXIT-INCLUDE or USER-TOP-INCLUDE
- 2811277 – Runtime error if form class library has not yet been created
Full note on SAP: SAP Support Launchpad note 2604054
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].