SAP security note 1429198, "Missing authorization check in RSUDO for "Execute as"", is a note. Below is the symptom.
Description
Symptom
Certain functions of transaction RSUDO can be called without the logged-on user having the prerequisite authorization for them. This can lead to an escalation of privileges.
When you execute a query with another user ("Execution as User") in transaction RSUDO, the system checks only during the initial start whether the user has sufficient authorization to execute the transaction with the entered user.
Reason and prerequisites
This problem is caused by a program error.
Transaction RSUDO does not have authorization checks that regulate repeated access to functions. Without these checks, a logged-on user can call these functions multiple times, leading to the possibility of an unwanted change in the system behavior.
Full note on SAP: SAP Support Launchpad note 1429198
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
