Thomas Fritsch
As a key SAP security researcher at Onapsis, Thomas Fritsch is a trusted authority on vulnerability management and emerging threats. Leveraging his extensive career as an SAP expert, he focuses on deeply technical areas like SAP system configuration and transport management. Thomas’s analysis of the latest SAP security patches and vulnerabilities is a core component of the research that provides the in-depth, actionable intelligence organizations need to protect their systems. His role as a respected speaker and publisher further establishes him as a definitive voice in the SAP cybersecurity space, helping to bridge the gap between complex research and real-world security practices.
SAP Patch Day: January 2024
Additional SAP BTP Applications affected by critical Privilege Escalation Vulnerability reported in December 2023
Global vs. Local Data Flow Analysis: Crucial in ABAP Code Security
Code security tools have to process a data flow analysis to identify vulnerabilities like SQL Injection, OS Command Injection, Code Injection, and Directory Traversal. The Market leading solution, Onapsis C4CA and other tools in the market follow different approaches with regard to this data flow analysis and the resulting finding management. While some tools only start a local data flow analysis, C4CA optionally executes a global data flow analysis.
SAP Patch Day: October 2023
SAP’s October Patch Day was extremely calm. The only Hot News Note is an update of SAP Security Note #2622660 which provides regular patches for SAP Business Client, including the latest tested Chromium patches. The rest of the published SAP Security Notes are of Medium Priority.
SAP Patch Day: September 2023
Critical Patches for SAP BusinessObjects and SAP CommonCryptoLib released
SAP Patch Day: August 2023
New HotNews Note for SAP PowerDesigner and Important Update on July HotNews Note
SAP Security Patch Day: July 2023
Important Patches for IS-OIL, Solution Manager, Web Dispatcher, and ICM
How to Securely Introduce Explicit AUTHORITY-CHECKS into Custom RFC-Enabled Function Modules
SAP customers often rely only on S_RFC authorizations to protect access to business data via RFC-enabled function modules (RFC FMs). This is risky because, due to the complexity of business scenarios, S_RFC authorizations are often assigned very generically (RFC_NAME = ‘*’ ). Another reason that S_RFC authorizations lack granularity is because in the past S_RFC authorizations could only be restricted on a function group level.