SAP security note 2463354, "Missing Authorization check in the ABAP Workbench tools". Below are the symptom and SAP recommended solution.
Description
Symptom
ABAP Workbench tools do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Some well-known impacts of Missing Authorization check are:
- Abuse functionality restricted to a particular user group
- Create restricted data
Solution
By the correction, the check on S_DEVELOP with restrictions on packages is strengthened. This may lead to the fact that create rights for some developers are not granted anymore. Hence, authorization S_DEVELOP for developers shall be reviewed.
Implement the correction with SNOTE or install the corresponding Support Package.
Reason and prerequisites
Prerequisite: You are using the authorization object S_DEVELOP with restrictions on packages, in particular for activity "Create" (01).
CVSS
Score 2.7 Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2463354
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].