High priority
SAP security note 1627922, "Missing authorization check in SAA_REMOTE_OP_TRANSACTION", was released on September 6, 2016. Below are the symptom, SAP recommended solution, reason and prerequisites and affected software components.
Description
Symptom
An authenticated user can use the function module SAA_REMOTE_OP_TRANSACTION to which access should be restricted. This may result in an escalation of privileges.
Solution
Due to the deprecation of the complete functionality of package SSAA, the entire SAA_REMOTE_OP_TRANSACTION function module has been commented out. The initiation of any operating system commands and function modules is now completely disabled within the function module.
To address this issue:
- Implement the attached correction instructions via SAP Note 1627922, or
- Apply the assigned support packages relevant to your SAP_BASIS version.
Reason and prerequisites
The function module SAA_REMOTE_OP_TRANSACTION does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This can lead to undesired system behavior and potential security vulnerabilities.
Affected components
- SAP_BASIS 46C to 731
Full note on SAP: SAP Support Launchpad note 1627922
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].