SAP Security Note
Medium priority
SAP security note 2592069, “Missing Authorization check in ABAP in Eclipse”, is a program error note released on 13.02.2018. Below are the symptom and SAP recommended solution.
Description
Symptom
ABAP in Eclipse does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Some well-known impacts of missing authorization check are:
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
The correction closes the gap in the authorization check and performs the standard authorization check for ABAP development.
Please implement the correction instruction of this SAP Note or the mentioned Support Package.
Reason and prerequisites
A legitimated user with S_DEVELOP is required. The user has only the right to display ABAP source code. Under some circumstances, this user can duplicate a report into $TMP. With the duplicated report, it might be possible to leverage the right to execute ABAP reports by choosing a report name that is in the user’s list of reports to be executed.
Full note on SAP: SAP Support Launchpad note 2592069
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
