界: Security Features

軟體安全性並非安全性軟體。我們關注驗證、Access Control、保密性、加密以及權限管理之類的主題。

Access Control: Privilege Escalation

Abstract
程式可能允許未獲授權的使用者執行為權限更高的使用者保留的指令。
Explanation
通常，SAP 應用程式中的授權檢查將針對執行應用程式的使用者 (登入的使用者) 執行。但是，可透過下列方式讓程式檢查不同使用者 (非登入的使用者) 的授權：
1. 在新增 FOR USER 的同時使用陳述式 AUTHORITY-CHECK
2. 透過指定的使用者呼叫函數模組 AUTHORITY_CHECK
3. 透過指定的使用者呼叫函數模組 SU_RAUTH_CHECK_FOR_USER

雖然這些檢查有時是必要的，但通常會造成權限提升的安全性風險。控制據以執行授權檢查之「使用者 id」輸入的惡意使用者，能夠欺騙系統提供已知的超級使用者 id (例如 SAP* 或 DDIC)，讓其存取原本禁止該名使用者存取的內容。

即使使用者沒有直接控制用於授權檢查的「使用者 id」，研究對不同使用者的授權亦是一個不良的作法，必須予以避免。在執行授權檢查時，無需明確指定登入的使用者 (sy-uname)。此為預設行為 - 明確指定登入的使用者只會為漏洞利用攻擊開啟方便之門，sy-uname 在實際執行檢查之前可能會受到控制。因此，一般而言，建議跳過檢查對不同使用者的授權，並且不特別明確指定登入的使用者。

範例 1：下列程式碼會在呼叫可能執行任何 ABAP 程式的交易之前檢查使用者授權。


...
AUTHORITY-CHECK OBJECT 'S_TCODE' FOR USER v_user
ID 'TCD' FIELD 'SA38'.
IF sy-subrc = 0.
CALL TRANSACTION 'SA38'.
ELSE.
...


在這種情況下，未獲授權的使用者能夠藉由向變數 v_user 提供已知的超級使用者 (例如 SAP* 或 DDIC) 而啟動任何 ABAP 程式。
References
[1] SAP OSS Notes 20534, 179145, 136647 and related ones.
[2] Standards Mapping - Common Weakness Enumeration CWE ID 863
[3] Standards Mapping - Common Weakness Enumeration Top 25 2023 [24] CWE ID 863
[4] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000213, CCI-001084, CCI-002165, CCI-002754
[5] Standards Mapping - FIPS200 AC
[6] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation
[7] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-3 Access Enforcement (P1), CM-5 Access Restrictions for Change (P1), IA-2 Identification and Authentication (Organizational Users) (P1), IA-11 Re-Authentication (P0), SC-3 Security Function Isolation (P1), SI-10 Information Input Validation (P1)
[8] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-3 Access Enforcement, CM-5 Access Restrictions for Change, IA-2 Identification and Authentication (Organizational Users), SC-3 Security Function Isolation, SC-11 Trusted Path, SI-10 Information Input Validation
[9] Standards Mapping - OWASP API 2023 API3 Broken Object Property Level Authorization
[10] Standards Mapping - OWASP Application Security Verification Standard 4.0 4.1.3 General Access Control Design (L1 L2 L3), 4.1.5 General Access Control Design (L1 L2 L3), 4.2.1 Operation Level Access Control (L1 L2 L3), 13.1.4 Generic Web Service Security Verification Requirements (L2 L3)
[11] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication
[12] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization
[13] Standards Mapping - OWASP Top 10 2004 A2 Broken Access Control
[14] Standards Mapping - OWASP Top 10 2007 A10 Failure to Restrict URL Access
[15] Standards Mapping - OWASP Top 10 2010 A8 Failure to Restrict URL Access
[16] Standards Mapping - OWASP Top 10 2013 A7 Missing Function Level Access Control
[17] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control
[18] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control
[19] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.2
[20] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.4
[21] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.8
[22] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.8
[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.8
[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.8
[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.8
[26] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[27] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control
[28] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control
[29] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls
[30] Standards Mapping - SANS Top 25 2009 Porous Defenses - CWE ID 285
[31] Standards Mapping - SANS Top 25 2010 Porous Defenses - CWE ID 285
[32] Standards Mapping - SANS Top 25 2011 Porous Defenses - CWE ID 862
[33] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3480.1 CAT II, APP3480.2 CAT II
[34] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3480.1 CAT I, APP3480.2 CAT II
[35] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3480.1 CAT I, APP3480.2 CAT II
[36] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3480.1 CAT I, APP3480.2 CAT II
[37] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3480.1 CAT I, APP3480.2 CAT II
[38] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3480.1 CAT I, APP3480.2 CAT II
[39] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3480.1 CAT I, APP3480.2 CAT II
[40] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[41] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[42] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[43] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[44] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[45] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[46] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[47] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[48] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[49] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[50] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[51] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[52] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[53] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-001410 CAT II, APSC-DV-001520 CAT II, APSC-DV-001530 CAT II, APSC-DV-001540 CAT I, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[54] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000460 CAT I, APSC-DV-000470 CAT II, APSC-DV-001410 CAT II, APSC-DV-001520 CAT II, APSC-DV-001530 CAT II, APSC-DV-001540 CAT I, APSC-DV-002360 CAT II, APSC-DV-002560 CAT I
[55] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authorization (WASC-02)
[56] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authorization
desc.structural.abap.access_control_privilege_escalation