Secure programming in ABAP

In today’s dangerous cyberspace where we experiencing a lot of attracts it is important to consider how SAP applications written in ABAP are protected. Here are introduced some of potential security treats to ABAP program. In addition there are some best practices how we can protect them.

Threats:

- Password hash attacks - hash value of a password calculated outside SAP and compared to the hash value that is stored in SAP.

- Dynamic SELECT statements – allows to takeover whole DB and possibility to read any table.

- No predefined authority checks - in CALL TRANSACTIONS.

- Executing OS commands – CALL SYSTEM via statement.

- Viruses - E.g. in files uploaded into SAP app. Servers.

- Changes in Master Data.

- Usage of HTTP within BSP, webdynpro apps. – HTTPS must be used.

- Catching passwords transmitted over HTTP by GET method – POST method must be used.

- Manipulating with URL - Attacks on WAS via HTTP protocol.

- Folders in URL - directory traversing possible.

- Cross-site scripting (XSS) – always check user input, there might be malicious code.

Best practices:

- In general protect following components of your SAP ABAP application server: RFC connections, system profile parameters files, Change and Transport system, Table (T000) for Maintaining System Clients,

- Use logging framework (TA SLG0, SLG1, SLG2), change documents functionality (SCDO); logging of customizing objects and tables (TA SCU3) – logging helps to identify problem, auditing, etc.

- Always check Security Audit Log (BC-SEC) – via TA SM20, SM20N.

- Use tool RSECNOTE checks security-relevant notes or HotNews that are entered as related notes in this present note.

- Secure Storage – To securely store data in WAS you this component. See TA SECSTORE.

- Trust Manager - tool used when there is a public-key technology in place with the SAP WAS ABAP server.

- Protect table contents against: export of using transports; access using existing generic tools (TA SE11, SE12, SE16, SE17); external DB access (using SQL tools).

- Disable debugging in Production environment.

- Restrict authorizations for maintaining/executing external OS commands.

- Protect Batch Input sessions – E.g. unauthorized access to files used by batch input, restrict batch input authorizations.

- Secure store and forward mechanism (SSF) as a part of SAP Security Library (SAPSECULIB) – functionality to support digital signatures (ensuring authenticity) and confidentiality of data transmission (encryption).

- Protecting disclosure of SAPconnect RFC User – tool with which ABAP Stack is communicating with external telecommunications services such as FAX, Internet, X.400 and the SAPoffice. It does use a non-dialog RFC user type of CPIC to log on to the external system. Proper authorization profile must be given.

- Preventing or logging list downloading – User can access this functionality via menu option System -> List -> Save as Local file in SAP GUI. Authorization object S_GUI exists to prevent a user from downloading lists.

- Internet Graphics Service (IGS) Security – IGS must be protected by firewall

- While loading data into SAP system (via file upload from front end, FTP server, application server or via electronic data exchange: XML, RFC, IDoc, SAP XI/PI) use SAP Virus Scan Interface (SVI) – SAP provides interface to scan files. This is standard interface called NetWeaver Virus Scan Interface (NW-VSI) available for both Application server stacks: ABAP and JAVA. It does allow 3^rd party antivirus software to scan data.

Useful links:

SAP NetWeaver Application Server ABAP Security Guide

service.sap.com/securitynotes

1394093 - Collective Security Note

888889 - Automatic checks for security notes using RSECNOTE

13202 - Security aspects in ABAP programming

2383 - Documentation: description of "super user" SAP*

1237762 - ABAP systems: Protection against password hash attacks

1394100 - Security note: Access to RFC-enabled modules via SOAP

821875 - Security settings in the message server

1392352 - Security note: Cross-site scripting in BW

1411701 - Generic ABAP function calls

1414112 - Security: Buffer overflow

1133739 - Security note: Security gap in Data Browser (SE16)

1387576 - CO-OM tools: SE16N: Authorization checks in view maintenance

1388864 - ABAP web services authorization check does not work

Hacker's Lunch @ SAP TechEd Vienna