SAP Bex – Insert Arbitrary Workbook inside Favorites
Impact on Business
An authenticated attacker could exploit this vulnerability to inject unauthorized content into the favorites workplace of other users. This could be used to mislead users or facilitate further attacks by directing them to malicious workbooks, impacting the integrity of the user’s workspace.
Vulnerability Details
An improper access control vulnerability exists in the SAP Business Explorer (BEx) component. A remote-enabled function module fails to adequately validate the authorization of the calling user when adding entries to the favorites list. Consequently, an authenticated user with low privileges can programmatically insert arbitrary workbook references into the favorites folder of any other user within the SAP system without their consent or administrative intervention.
Solution
SAP has released SAP Note 3488039 which provides patched versions of the affected components.
The patches can be downloaded from https://me.sap.com/notes/3488039.
Onapsis strongly recommends SAP customers to download the related security fixes and apply them to the affected components in order to reduce business risks.
Report Timeline
- 06/03/2024: Onapsis reports vulnerability to SAP
- 09/10/2024: SAP issues the patch
References
Advisory Information
- Public Release Date: 08/05/2026
- Security Advisory ID: ONAPSIS-2026-0006
- Researcher(s): Adrian Radulescu
Vulnerability Information
- Vendor: SAP
- Affected Components: SAP NetWeaver ABAP (SAP Basis), SAP Business Explorer (BEx) (Check SAP Note 3488039 for detailed information on affected releases)
- Vulnerability Class: CWE-284: Improper Access Control
- CVSS v3 score: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- Risk Level: Medium
- Assigned CVE: CVE-2024-44116
- Vendor patch Information: SAP Security NOTE 3488039
Affected Components Description
The vulnerability affects components within SAP NetWeaver ABAP that handle the Business Explorer (BEx) Analyzer functionality. Specifically, it involves the management of user workplace favorites and the processing of workbook assignments via Remote Function Calls (RFC).
About our Research Labs
Onapsis Research Labs provides the industry analysis of key security issues that impact mission-critical systems and applications. Delivering frequent and timely security and compliance advisories with associated risk levels, Onapsis Research Labs combine in-depth knowledge and experience to deliver technical and business-context with sound security judgment to the broader information security community.
Find all reported vulnerabilities at: https://github.com/Onapsis/vulnerability_advisories
This advisory is licensed under a Creative Commons 4.0 BY-ND International License