SAP security note 1503022, “Missing authorization checks in DOE”. Below are the symptom and the SAP recommended solution.
Description
Symptom
Authorization checks are missing for some clean up reports and remote enabled function modules in Data Orchestration Engine.
Solution
Authorization checks have been introduced.
- Apply SP11 if you are on WebAs 7.10
- Apply SP06 if you are on WebAs 7.11
Reason and prerequisites
The following reports are typically executed by DOE administrators for cleaning up logs and older Data Object messages. Currently, authorization checks are missing for these reports. After the fix, the role SAP_DOE_ADMINISTRATOR is required to execute these reports.
- SMMW_REORG_LOG
- SMMW_REORG_MSG_STORE
- MMW_MON_LOGFILES_CLEANUP
Additionally, one function module identified in the security code scan can be accessed remotely without DOE-specific authorizations. After the fix, the role SAP_DOE_SYNC_ROLE is required to access this function module.
- SMMW_DEVICE_DISCOVERY
Prerequisite: you are on a Support Package (SP) lower than SP 11 of WebAs 7.10, or you are on a Support Package (SP) lower than SP 06 of WebAs 7.11.
Full note on SAP: SAP Support Launchpad note 1503022
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
