3738320 - rsbdcos0 allows unlogged os command run via “change current directory” (sm21 not updated)

• Using program RSBDCOS0 to run operating system commands is normally reflected in SM21, but commands appended in the “Change current directory” field using shell operators like “&&” run without appearing in SM21.
• Example pattern: enter a path followed by “&& id && cat /etc/passwd”; the additional commands run while SM21 does not show a corresponding entry.
• The output from such appended commands is not shown in the RSBDCOS0 list for the “change directory” action; the list updates only for the standard run function.
• The appended commands are stored together with the path and can run again when items in the list are started, because a change-directory is implicitly concatenated.
• In kernel snapshots (for example via work process snapshots), the full command chain may be visible under “Change working directory,” while SM21 does not show it.

SAP NetWeaver Application Server for ABAP, ABAP Platform

rsbdcos0, change current directory, sm21, system log, unlogged commands, os command, shell operator, &&, abap as, security, vulnerability, logging bypass, cd function, syslog, monitoring , KBA , BC-ABA-SC , Dynpro and CUA engine , Problem