No authorization check for editor, SAP security note 1357370

SAP security note 1357370, "No authorization check for editor", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses an issue where certain programs allow users to start the editor in change mode without the necessary development authorization (authorization object S_DEVELOP). Although changes made in the editor are typically not transferred to the current process and are used only to display dynamically generated ABAP or SQL, there is uncertainty regarding the execution of the modified source code. The attached corrections ensure that the change authorization is always verified, and the editor is opened in display mode if the user lacks the required authorization.

• Users can initiate the editor in change mode without having the relevant development authorization (S_DEVELOP).
• Changes made in the editor are not consistently transferred, posing a potential security risk.

Solution

Implement the correction instructions provided in the security note. After applying the corrections, the system will check for development authorization before opening the editor. If the authorization is missing, the editor will only open in display mode.

Reason and prerequisites

The issue is caused by a program error within the SAP system.

CVSS

Score 0

References

• Restriction on Code injection vulnerability in BW-BEX-OT
• Collective Security Note
• SAPBWNews BW 7.00 ABAP SP 21
• SAPBWNews BW 7.11 ABAP SP 03
• SAPBWNews BW 7.10 ABAP SP 08
• SAPBWNews BW 7.01 ABAP SP 04
• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BW: 20B, 21C, 30B, 310, 350, 700 to 702, 710 to 720
• SAP_BW_VIRTUAL_COMP: 30B, 701