界: Security Features
软件安全不是安全软件。此处我们关注的主题包括身份验证、Access Control、机密性、加密和权限管理。
Access Control: Privilege Escalation
Abstract
程序可能会允许非授权用户执行仅对权限更高的用户可用的命令。
Explanation
正常情况下,SAP 应用程序会对执行此应用程序的用户(已登录用户)执行授权检查。但是,它可能会通过下列方式检查其他用户(非登录用户)的授权:
1. 使用
2. 对指定的用户调用
3. 对指定的用户调用
尽管有时候存在执行的必要,但执行此类检查常常会导致权限扩大安全风险。如果恶意用户可以控制执行授权检查所针对的“用户 ID”输入,该用户将能够通过提供已知超级用户(如 SAP* 或 DDIC)诱使系统提供禁止该用户享有的访问权限。
即使用户无法直接控制用于授权检查的“用户 ID”,探测其他用户的授权也是一项不好的行为,需要加以避免。执行授权检查时无需明确指定登录用户 (sy-uname)。这是默认的操作方式,因为明确指定登录用户只会让攻击者有机可趁,即 sy-uname 在实际执行检查前被操控。因此,一般情况下最好跳过另外一名用户的检查授权,特别是不要明确指定登录用户。
例 1: 以下代码首先检查用户授权,然后再调用可执行任何 ABAP 程序的事务。
在此示例中,非授权用户可通过为变量 v_user 提供已知超级用户(如 SAP* 或 DDIC)启动任何 ABAP 程序。
1. 使用
AUTHORITY-CHECK
语句,同时附加 FOR USER
2. 对指定的用户调用
AUTHORITY_CHECK
函数模块3. 对指定的用户调用
SU_RAUTH_CHECK_FOR_USER
函数模块尽管有时候存在执行的必要,但执行此类检查常常会导致权限扩大安全风险。如果恶意用户可以控制执行授权检查所针对的“用户 ID”输入,该用户将能够通过提供已知超级用户(如 SAP* 或 DDIC)诱使系统提供禁止该用户享有的访问权限。
即使用户无法直接控制用于授权检查的“用户 ID”,探测其他用户的授权也是一项不好的行为,需要加以避免。执行授权检查时无需明确指定登录用户 (sy-uname)。这是默认的操作方式,因为明确指定登录用户只会让攻击者有机可趁,即 sy-uname 在实际执行检查前被操控。因此,一般情况下最好跳过另外一名用户的检查授权,特别是不要明确指定登录用户。
例 1: 以下代码首先检查用户授权,然后再调用可执行任何 ABAP 程序的事务。
...
AUTHORITY-CHECK OBJECT 'S_TCODE' FOR USER v_user
ID 'TCD' FIELD 'SA38'.
IF sy-subrc = 0.
CALL TRANSACTION 'SA38'.
ELSE.
...
在此示例中,非授权用户可通过为变量 v_user 提供已知超级用户(如 SAP* 或 DDIC)启动任何 ABAP 程序。
References
[1] SAP OSS Notes 20534, 179145, 136647 and related ones.
[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 3.0
[3] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete
[4] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3.0
[5] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1
[6] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity
[7] Standards Mapping - CIS Kubernetes Benchmark partial
[8] Standards Mapping - Common Weakness Enumeration CWE ID 863
[9] Standards Mapping - Common Weakness Enumeration Top 25 2023 [24] CWE ID 863
[10] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084, CCI-002165, CCI-002754
[11] Standards Mapping - FIPS200 AC
[12] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation
[13] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1), CM-5 Access Restrictions for Change (P1), IA-2 Identification and Authentication (Organizational Users) (P1), IA-11 Re-Authentication (P0), SC-3 Security Function Isolation (P1), SI-10 Information Input Validation (P1)
[14] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement, CM-5 Access Restrictions for Change, IA-2 Identification and Authentication (Organizational Users), SC-3 Security Function Isolation, SI-10 Information Input Validation
[15] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control
[16] Standards Mapping - OWASP Top 10 2007 A10 Failure to Restrict URL Access
[17] Standards Mapping - OWASP Top 10 2010 A8 Failure to Restrict URL Access
[18] Standards Mapping - OWASP Top 10 2013 A7 Missing Function Level Access Control
[19] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control
[20] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control
[21] Standards Mapping - OWASP API 2023 API3 Broken Object Property Level Authorization
[22] Standards Mapping - OWASP Application Security Verification Standard 4.0 4.1.3 General Access Control Design (L1 L2 L3), 4.1.5 General Access Control Design (L1 L2 L3), 4.2.1 Operation Level Access Control (L1 L2 L3), 13.1.4 Generic Web Service Security Verification Requirements (L2 L3)
[23] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication
[24] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization
[25] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.2
[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.4
[27] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8
[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8
[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8
[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8
[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8
[32] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[33] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control
[34] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control
[35] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls
[36] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285
[37] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285
[38] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 862
[39] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.1 CAT II, APP3480.2 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.1 CAT I, APP3480.2 CAT II
[41] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.1 CAT I, APP3480.2 CAT II
[42] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.1 CAT I, APP3480.2 CAT II
[43] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.1 CAT I, APP3480.2 CAT II
[44] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.1 CAT I, APP3480.2 CAT II
[45] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.1 CAT I, APP3480.2 CAT II
[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[47] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[48] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[49] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[50] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[51] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[52] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[53] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[54] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[55] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[56] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[57] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[58] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[59] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-001410 CAT II, APSC-DV-001520 CAT II, APSC-DV-001530 CAT II, APSC-DV-001540 CAT I, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[60] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)
[61] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization
desc.structural.abap.access_control_privilege_escalation