SAP security note 1644896, "Missing authorization check in SAP NetWeaver BPM Task Management". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can receive delegated tasks of SAP NetWeaver BPM Task Management to which access should be restricted. This may result in an escalation of privileges.
Solution
By applying the correction contained in one of the Support Packages listed below, the behavior of the UME Principal Selector Dialog used in the context of SAP NetWeaver BPM Task Management will be changed as follows:
- The dialog will only return UME users that belong to the "BPEM End User" role (unique name: "pcd:portal_content/com.sap.pct/every_user/com.sap.bpem/com.sap.bpem.roles/com.sap.bpem.Enduser"). This role will be added as an implicit, additional search criterion.
- As a result, it will no longer be possible to delegate SAP NetWeaver BPM Tasks to any UME user outside of this role.
Reason and prerequisites
SAP NetWeaver BPM Task Management does not contain authorization checks for verifying an authenticated user’s authorization to receive delegated tasks. This oversight may lead to undesired system behavior.
Affected components
- BPEM-WDUI
- BPEM-HIM
- BPEM-MON
- BPEM NWA PLUG INS
- BPEM WEBDYNPRO UIS
- BPEM HUMAN INTERFACE MGMT
Full note on SAP: SAP Support Launchpad note 1644896
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].