Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Missing authorization check in FM PRGN_INTERFACE_USER, SAP security note 1406435

Description

The function modules SUPRN_INS_OR_DEL_PROFILE and PRGN_INTERFACE_USER (that are intended for internal use) allow you to avoid the authorization check of the user management.
The module PRGN_INTERFACE_USER contains a parameter for controlling the necessity of the authorization check.
If this parameter is not set, authorization profiles can be added to a user, although the executing user does not have the required authorizations for the user management.  The function module SUPRN_INS_OR_DEL_PROFILE uses this feature.
As a result, you can assign authorizations to yourself or other users for which you have no authorizations.
Such a use is not possible in the standard programs provided by SAP. However, if you call the modules using this option in customer-specific programs or using transaction SE37 in test mode, it is possible to avoid existing authorization concepts.

Available fix and Supported packages

  • SAP_APPL | 45B | 45B
  • SAP_BASIS | 46B | 46C
  • SAP_BASIS | 620 | 640
  • SAP_BASIS | 700 | 702
  • SAP_BASIS | 710 | 720
  • SAP_APPL 45B | SAPKH45B67 |
  • SAP_BASIS 46B | SAPKB46B62 |
  • SAP_BASIS 710 | SAPKB71010 |
  • SAP_BASIS 711 | SAPKB71105 |
  • SAP_BASIS 46C | SAPKB46C60 |
  • SAP_BASIS 620 | SAPKB62068 |
  • SAP_BASIS 640 | SAPKB64026 |
  • SAP_BASIS 720 | SAPKB72003 |
  • SAP_BASIS 702 | SAPKB70203 |
  • SAP_BASIS 700 | SAPKB70022 |
  • SAP_BASIS 701 | SAPKB70107 |

Affected component

    BC-SEC-AUT
    Authorization

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected].

URL

https://launchpad.support.sap.com/#/notes/1406435

TAGS

#PERFORM_CHECKSSUPRN_INS_OR_DEL_PROF
#PRGN_INTERFACE_USES_USER_SAS
#S_USER_GRP-S_USER_PROPRGN_USERPROF
#SUPRNS_DEVELOP-(ACTVT16&x00A0-&x00A0-OBJTYPEFUGR&x00A0-&x00A0-OBJNAMESUPRN)S_DEVELOP-(ACTVT16&x00A0-&x00A0-OBJTYPEFUGR&x00A0-&x00A0-OBJNAMEPRGN_USERPROF)

More to explorer

SAP Security For All

RedRays Security Platform for Penetration testers and Bug hunters

The product package is specifically created for cyber security experts who have encountered SAP while participating in bug bounty programs.

RedRays Security Platform for SAP Consultants

The product package is designed for SAP consultants conducting security assessments of SAP ERP systems. We provide essential tools and resources to help professionals in this field conduct their work effectively.

RedRays Security Platform for Enterprises

The product package is specifically optimized to cater to the needs of both small/medium and large companies who are seeking to streamline the process of organizing a comprehensive security system for ERP systems.