The world of profile parameters in SAP is vast and complicated as a user can change the entire behavior of the SAP by modifying some of these parameters.
But just when we thought that we knew everything about profile parameters, we recently discovered something very interesting.
SAP Security Note 1979454 is related to a vulnerability in transaction SHDB (a very sensitive transaction since it’s used to create recordings) which introduced a new profile parameter called “bdc/shdb/auth_check”.
The problem with SHDB is that it wasn’t checking any authorization object besides from the S_TCODE, and a user with access only to the transaction could see any recording made by any user. If the user recorded a user creation the password would be shown in plain text. To mitigate this risk an authority check was introduced inside the programs, which would check for the authorization object S_BDC_MONI. However to enable this check, the parameter bdc/shdb/auth_check needs to be set to TRUE.
While going through the correction instructions for this note, we noticed that there wasn’t an update for the SAP Kernel (whenever a new profile parameter is introduced, there should be an update to the Kernel), so we decided to test the correction instructions to see how this parameter worked.