SAP Security Note
Medium priority
SAP security note 1933777, "Missing whitelist check in XX-CSC-RU-FI", is a program error note released on 29.04.2014. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of XX-CSC-RU-FI to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the support package or apply the correction instructions provided in this note. No additional manual activities are required to maintain the whitelist.
Reason and prerequisites
XX-CSC-RU-FI does not contain required checks against a positive set of allowed functions (i.e., whitelist) during the execution of these functions. This is necessary to verify that authenticated users are permitted to access these functions. The missing check may lead to undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1933777
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
