SAP Authorization Vulnerability
Key Takeaways
⇨ Third party solutions can be used to scan the customer code base for vulnerabilities
⇨ It’s challenging for organizations to keep up with the publication of SAP security notes
⇨ The impact of missing authorization vulnerability is that unauthorized users may access critical business functions
The missing authorization vulnerability in SAP ABAP/4, caused by a programming flaw, can be secured. The solution lies in using an authorization concept, which works if the function’s developer(s) have planned for authorization checks within SAP systems customer’s code base, according to Christoph Nagy CEO at SecurityBridge, a global SAP security provider.
“In SAP ABAP/4 programming, a so-called return code allows the developer to determine whether the authorization check was successful,” Nagy told SAPinsider, adding, “Unfortunately, there are numerous scenarios where the authorization check exists, but the logic to handle the check’s response does not exist or is insufficient.”
This is a pure coding flaw that can only be corrected by a code correction. If the problem exists within SAP standard then SAP needs to provide a patch and clients need to install the patch. In case the incorrect or missing authorization check resided within the customer code base it is the sole responsibility of the customer to apply a code correction. The impact of missing authorization vulnerability is that unauthorized users may access critical business functions and perform actions they should not be able to accomplish, which can lead to data breaches, sensitive information loss, and financial losses.
While it’s challenging for organizations to keep up with the publication of SAP security notes for the extensive product portfolios, ABAP development teams do check for these types of vulnerabilities using analyzer tools on the market that offer essential functions for this purpose, which are constantly available throughout the development process. Third party solutions can be used to scan the customer code base for vulnerabilities and ensure that relevant security patches for SAP application installations are always known and can be implemented without delay.
